Google and others are also not allowed to do blanket data collection by law, they are restricted in how and who's data they can collect with stuff like the GDPR.

You can debate how effective it is, but they are not allowed to do it, and nobody should be allowed to either.