@Em0nM4stodon@infosec.exchange Consent is often abused, even when the letter of the law is followed. There should be statutory rules that ban certain types of data collection and any data that could infer them, e.g. sexual orientation, political convictions or religion. But more importantly, there needs to be enforcement, with teeth. The GDPR looks good on paper but is not enforced due to malicious (non)compliance by the Irish DPA, I fear the EU AI Act will go the same way.