Data protection laws would still limit what companies could do with the data after they obtained it, even if they required that data to access the site.