Ah, I see, I think we're talking past one another. I was critiquing this approach from a technical perspective, since once data is sent over the wire, I don't know of any good way to figure out what's being done with it, and whether in complies with any given policy (including GDPR). E.g. we can see if the _browser_ is connecting to Cloudflare in the US, but what if a connection to a US server is happening on the backend?
If I'm understanding your point, it's more along the lines of: "Lots of people are looking into this sort of thing, and we can aggregate resources about their findings." This makes sense to me, but wasn't what I was intending to critique.