Am I missing something? Services are allowed to collect the data they need to perform their essential function right? (my reading says yes)
This just says: don't collect info on children you don't need and assume people are protected unless you verify otherwise.
Just don't collect the info you don't need. Seems straight-forward to me.