Copyright is copyright everywhere, it's actually a much more annoying topic in lawsuit-friendly US.

GDPR - by now everyone knows what to (not) do to avoid problems with that: just let people be in control of their data. If you can't guarantee that, it means you're doing shady shit that you probably shouldn't be doing.