Given that legislation will realistically never keep pace with technology, would it be crazy to implement whitelist data collection law, i.e., no data can be collected unless explicitly allowed? Hypothetically, of course — congress actually putting something like this into law is a different story.