>Even if you have a legitimate use case you still need to provide users a way to access all their information and delete all their information.

Which, in the EU at least, you have had to do for decades under the Data Protection Directive.