Comment by Rygian

It's already illegal in Europe, as long as the data falls into the PII category.