Frankly, I don't really collect user data that isn't effectively public... I've run a telnet BBS and thinking of throwing it up again, and like most developers have a few ideas on creating something. I don't do metrics tracking, but might throw up something like google analytics, or even adds in a game/web-app.

In the end, I frankly don't even like using passwords, I'd rather just have users use SSO from one of so many provider options. One of my criticisms early on of FB is they didn't have an early option to JUST get the real name and email address of their users. That's all most of these identity providers should give... enough to shoot a notification email and know the name of the person.

In the end though, who knows... working on something now, I may comply as much as possible just to be nice. Exported data will only have hashed IDs of "friend" accounts, with everything else effectively public.

I generally try to do the right thing in what I do always. It gets harder in a politically charged society at large.