Do you send user data anywhere in a way users may not expect? If not there's probably nothing to comply with. It's really the opposite of bureaucratic law — the entire thing is quite readable and reasonable.