Indirectly GDPR does this. All data collection must be either opt in, or necessary to provide the service.
Any company being truthful about what their customers want can't be tracking them 24-7 and sifting everything they type. Almost no-one wants that level of invasiveness. We just put up with it because there are no real (easy) alternatives or aren't aware.