Before I start: This is not legal advice and this should not be taken as such. I am not responsible for any illegal actions executed after this post.
That being said: Let's start.
Privacy Policies. When the GDPR was taken into action, everyone was really scared of having to pay millions for a minor violation in theirs.
Now that the GDPR is almost no topic of conversation anymore, I wanted to talk about how you should, in the best case, go about collecting user data.
I really only have one thing to say when it comes to that, which is: Just don't
Yes, that's right. Don't collect user data.
First of all: When something goes wrong, the best source to get to know about that is either regularily testing your stuff or letting the users submit bug reports.
When it comes to "Improving our Service", collected user data doen't really help much.
So, let's be honest: The only reason all those website collect data is money.
It's no new thing, nothing to be shocked about. Even if you just spend a bit online (if that's the case, I really wonder how you got here btw) you should know that.
But why? If you want to earn money, there's so many other options: