have you considered adding a good PII protection laws to circumvent that? GDPR seems to work pretty well.