Tech firms evading ‘basic limits on their ability to collect, monetise data’