Data collection is also part of the regulations; only collecting the data they need. Tracking data they do not even use seems to me to be a clear violation.