It sounds like someone needs to bring a similar suit in the EU and point to the GDPR. Where is the agreement to specific processing, the chance to opt out of the data collection, etc.