As for the second part (separate authentication methods), sure, would be rather problematic if they require you to have a phone, but that's a completely separate and different issue.
Companies tend not to do illegal things. Especially if they’re public or have shareholders that might lose significant value if found out. And it’s borderline impossible to stop people finding out.
The trouble with data laws is that once they have your data, they're the only ones who actually know what they're doing with it. Which means the thing you need to prevent is them having it, which is typically not the thing those laws do.
Which only helps if you're trying to prevent them from collecting the data rather than use it for a given thing, which is the thing they're not doing.
As an obvious example, if they keep all your files/messages on their cloud storage by default, they have all your files/messages by default.
> and you can - as a government - actually just go to their servers and check what they are doing (with necessary permits and lawful action)
Which generally only happens when you have reason to suspect they're doing something, which is the thing you wouldn't have when they're the only ones who know that they're doing it.
And even if you do go to look at the servers they have in your jurisdiction, there is no way to tell that the data hasn't been copied to servers outside of your jurisdiction, or what is happening to it over there.
First of all, most companies just want to make money, with minimal risk. It's significantly easier to make money when you are at worst doing grey area stuff and stay mostly legal (or even "better" is to lobby your thing into being legal). And any info known by more than 2 people is no longer a secret, and you ain't paying enough to your employees to lie under oath for their employer. So no, I don't believe it's happening all too often, and even if it does happen it's mostly out of ignorance, not a deliberate attempt to go against the law.
Look at the stuff Apple does, openly and in front of everybody, in response to laws they don't like, e.g. EU DMA. Now what is a scummy surveillance corporation going to do in the face of a law which there is no easy way to tell if they're violating?
> And any info known by more than 2 people is no longer a secret, and you ain't paying enough to your employees to lie under oath for their employer.
Consider how a large company works. Suppose as many as 95% of the employees are honest and/or risk-averse. Those 95% don't do it. When the remaining 5% do it without even being asked to because it's the thing that makes number go up and number going up is what gets them a bonus, they aren't going to tell on themselves and the other 95% don't even know that it's happening. Really the other >99% because 5% of people being willing to do it doesn't require 5% of people to be in on it.
> even if it does happen it's mostly out of ignorance, not a deliberate attempt to go against the law.
Getting screwed by ignorance rather than malice is still getting screwed.
If you have Google Play in the same sandbox as your banking app, why can't Google access everything there? Or are they in different sandboxes?
If you dont need any of the above its perfectly fine to run the banking app on your single, main profile.
It's getting somewhat annoying nowadays with banks pushing that crap, but fortunately legislation for access of people with disabilites forces them to provide tokens still.
A lot of them now switched to banking apps on the phone acting as token without a chance to opt out, though, so as a result I've stopped doing anything bank related on phones nowadays.