Unless the data collected is of a user that is an EU citizen. This needs prior approval and consent per GDPR.