I've been working at EU startups and tech for a while now. There isn't much worry about data laws. All the data you need for the real product you can get without even getting close to breaking any privacy laws.

It only gets very complicated when you start forwarding that data to 3rd parties, intensively tracking + storing user behaviour and engineering patterns aimed at deceiving how you use the data.

If you're that worried about keeping up to date on these types of rules, you can subscribe to the EU data protection newsletter, which will be a fairly decent overview on what's going on: https://edps.europa.eu/press-publications/publications/newsl...