[Lio]

The real issue here is the word "users".

They're silently collecting very personal information, without permission, from people that not users.

You can't object to Tiktok collecting information about your mental health because you're not told they're collecting it in the first place.

[CalRobert]

Presumably an EU citizen _could_ make a GDPR subject access request to see what they have, but this seems unlikely to work.

[Nextgrid]

They can just ignore it and get away with it: https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-...

The "success" of GDPR is greatly overstated here. In practice, breaching it is the winning strategy.

[Lio]

I guess to complete GDPR request you'd have to send them some of your personal information to identify yourself too. :(