The one good way forward I can see for any such privacy-conscious service provider is to let the user see exactly what data is stored about them (and purge it where feasible).

You store my access times and IP addresses? I should see that.

I think this would align well with GDPR, too.