> (which some will quickly point out is very GDPR-like)

I hope not. Knowing what data is collected and when is rarely argued against by anyone. Requiring the ability to provide it, provide services without it, large penalty maximums, explicit opt-in requirement, vagueness, non-enforceability, etc (etc, etc, etc) are often what people complain about wrt overreach.