It only gets very complicated when you start forwarding that data to 3rd parties, intensively tracking + storing user behaviour and engineering patterns aimed at deceiving how you use the data.
If you're that worried about keeping up to date on these types of rules, you can subscribe to the EU data protection newsletter, which will be a fairly decent overview on what's going on: https://edps.europa.eu/press-publications/publications/newsl...