And any EU citizen could proceed to sue the shit out of you and anyone who uses that data, based on GDPR. Especially, once you not only collect it, but also run any kind of inference on it.
Would be interesting to see where that ends. Once you start selling it, you act as some kind of company/have commercial interest and thereby clearly fall under GDPR. If they've never given their consent to your data processing, it would be best if your servers stand on some offshore oil rig and your bank account is somewhere on the Bahamas I guess...