> Is there any other industry where the client is responsible for making sure the service or product is legal and not the producer?

Let's remember, for context, that the EU is saying that the US is an "unsafe" third party country. While this is certainly true under a given definition of safe/unsafe, I doubt (m)any European citizens can point to harm as a direct result of their data being subpoenaed under the US CLOUD act. I am not saying there isn't a real problem but as I mentioned in another comment, the US and EU have agreed "in principle" on a third privacy shield to satisfy concerns on both sides and we are now waiting for it to be codified and tested in courts.