On May 25, the European Union’s General Data Protection Regulation (GDPR) goes into effect. Although the law bans companies from forcing its users to give up personal data as a condition of service, it allows for exceptions, such as when the information is necessary to fulfill a contract. Those exceptions are the new battlefield over privacy issues, including what “freely given” consent means. At the crux is “behavioral advertising,” worth billions of dollars annually, that targets users based on their Internet activity.

The Wall Street Journal reports that, “Facebook has continued work to comply with the new European law … in part by asking users in the EU to opt in to being shown targeted advertising” — or delete their accounts. “If you don’t accept these, you can’t continue to use Facebook,” says a pop-up about the company’s new terms and conditions.

“There are certain elements of the service which are core to providing it and which people can’t opt out of entirely, like ads,” said Facebook global deputy chief privacy officer Stephen Deadman. “There’s no point in buying a car and then saying you want it without the wheels. You can choose different kinds of wheels, but you need wheels.”

Facebook’s EU base is in Ireland, where that country’s Office of Data Protection Commissioner is looking into such a “contractual necessity to justify the collection or processing of some data under GDPR.” A spokesperson for the irish agency deemed it “unlikely” that contractual necessity would be a valid reason for “collection and processing of personal data arising from tracking off-platform.”

Google, which justifies its data collection via “legitimate interest,” also doesn’t let users opt out completely from data collection. Verizon Communications’ Oath, which includes AOL and Yahoo, said that, if users deny consent to collecting data, they “may not have access to all (or any) of our services.”

Once the GDPR goes into effect, some privacy rights groups are ready to lodge “collective complaints, akin to class-action lawsuits.” France’s La Quadrature du Net is “is readying a series of complaints against large tech companies on the question of whether consent is freely given.” “All of these legal concepts will be scrutinized to death for years to come,” said Hogan Lovells privacy lawyer Eduardo Ustaran.

The New York Times reports that the proposed ballot measure dubbed the California Consumer Privacy Act of 2018 would, if passed, “be one of the most meaningful checks in the United States on the growing power of Internet behemoths.” The initiative is the “passion project” of “a real estate developer, a former Central Intelligence Agency analyst and a financial industry executive” who “have no political aspirations” but are simply “a little freaked out about tech firms gobbling up people’s personal data.”

The proposed measure “gives consumers the right to ask companies to disclose what data they have collected on them; the right to demand that they not sell the data or share with third parties for business purposes; and the right to sue or fine companies that violate the law.” Facebook, Google, California’s Chamber of Commerce and telecommunications companies, all against the measure, are expected to spend $100 million to defeat it.