Other examples include:
* Trading card game booster packs vs. video game loot boxes
* Taking notes about people who visit your physical store vs. taking notes about people who browse to your website
That said - I do realize I'm in the minority opinion here re: GDPR, etc. But the inconsistency really disturbs me, I don't agree with a ban on facial recognition: who is to tell someone what they can and can't do with a bucket of bits? What about other automated recognition for content moderation - surely automatically detecting nudity is OK by the law? But what if those recognition models wind up doing some form of emergent facial recognition via unsupervised learning? How could someone even verify that?