I mean you /do/ understand that they're just switching the means collecting data, right? You /do/ understand that Alphabet doesn't need to care about cookie banners and web fonts when they can simply tell their gigantic user base to keep logged in to not see any banner anymore? You /do/ understand that webpages switched to dark UI patterns luring their visitors into "yes to all" clicks taking those as a charter to push them into even more ad networks? You /do/ understand that you will need to consult a lawyer's advice for anything touching PII data to be on the safe side and don't want your small business to potentially going bankrupt? You /do/ understand that this costs additional money that won't go into product development?

Edit: In addition with AI act and its very broad definition of what an AI is and a classification like "Education" you might end up in level "highest risk" just for calculating statistics on your quiz app (no one knows until a court rules). With Cyber Resilience Act and its application of the (physical) supply chain direction, your open source repo from 5 years ago might end up being a footgun with you being personally accountable for other companies using it in their product. And so on...