Basically when personal data is collected. The more these contribute to the fact that conclusions can be drawn about a specific person , the more critical methods are to be assessed. Collecting user data without consent is not legally compliant.