You think your data/activity isn't being monitized?

I did mention tracking?

Which isn't the same as single site collection or even selling "anonomizied" aggregate data or training data.

I certainly meant the regulation to cover those. To be able to sell data about user behavior, you have to track it, regardless of whether across several sites or just a single site.

Well, that's not typically what's meant or else security access log would be completely illegal.