“Just” like with GDPR, “just” follow the rules for personal data management. In reality, compliance stuff like that is expensive to implement.

So if you are going to require it, don’t pretend it is without cost. Which is exactly what you seem to be doing.