The EU standard also leaves much to be desired, although it is still light years away from the (non-existent) US regulation. Now, the terms must be separated, it is legitimate for a company to finance its services, either by a monthly payment, or by placing advertisements. What is not legitimate is placing advertisements based on the user’s activities and data that are recorded and sold to third parties, because this, apart from a violation of the right to privacy, is also a real risk for the user, since they have no more control over this data and how it is used or protected. Dozens of sensitive data leaks (banking, medical and others) in the past from Fakebook, Google, Amazon… clearly show this risk. It is therefore to be welcomed that the EU cuts off the tap on these companies.