> The solution here shouldn't be technical; it should be legal

Technical solutions tend to last longer. Legal solutions have a habit of being ignored when they become inconvenient.

The legal default should be that collecting this sort of data should always be illegal without informed consent and never used beyond the remit of that consent. As inconvenient as it sometimes is, the world needs GDPR.