That's 500 million people (EU), 25 Million people (California), and of course you forget about all the other places that have PII data protection laws, like Virginia, Colorado, Connecticut, Utah, and increasingly more US states. Then, of course, there is Canada, the UK, Brazil, South Korea, Japan, Australia, New Zealand, India, South Africa, Singapore, Israel, all of which have GDPR-compatible laws or are quickly approaching it.

I am no lawyer. Before collecting data, better talk to one.