Technically, Daybreak has that in their Terms of Service. By using their software, it's implied that you consent to having that information collected. It pops up when you log into the game for the first time.
That is enough to cover their asses legally. If you decline on the launcher, you can't play the game and the launcher closes.
They can also terminate your account for any reason - and they don't have to disclose the reason you were terminated. A fair comparison would be a restaurant kicking you out, and not telling you the reason why. They have the right to refuse to service you, just like you don't have to bake a cake for a gay couple in the US as a Christian baker.
Everyone collects information that is borderline personally identifying these days, even with the EU's GDPR in effect. Chat logs, running processes, hardware information, IP addresses, geolocations, analytics information (ie; how often you log into a game and at what hours, where you spend your Daybreak Currency, etc)
I'd be more worried about companies misusing your info, not collecting it. There are no guarantees P99 will handle your information better than Daybreak - worse, bigger companies can avoid penalties for misusing it by being too big to care about fines or regulations. See: Facebook / Cambridge Analytica. I'd trust Rogean to handle it better provided you didn't piss him off in some way... like RyanTwin20 did recently by calling Rogean's employer.
For the richest of the rich companies (ie; once you get past the 10 million net revenue mark), everything is legal if it only results in a small fine.
And as for P99's information gathering (they don't track much more than confirmed detections these days, Rogean had to roll back a lot of the invasive techniques), they could argue you're breaking someone else's terms of service to play on their service, thus you were operating illegally by accessing P99 and P99 had no wrongdoing.
I am 100% certain because emulator folks who were simply running MySEQ on the test server to collect spawn information were hit with bans, and have otherwise not used those accounts for any other purpose, and MQ2 was not loaded. Additionally, accounts that were running MQ2 on test that were run by separate emu developers 8 months prior were also banned around the same time. They only had MQ2 loaded to collect spawn data on the test server and parse NPC statistics. But still, they had MQ2 loaded. I believe they had a build of MQ2 from EQMule or Maudigan which didn't have the protections MQNext has.
This banwave coincided with Accendo posting a warning on the EQ forums about people ceasing cheating. Nearly every time they have done a massive banwave, developers normally warn people that they are going to do it beforehand.
There is a function in the game client that compares the name of running 32-bit processes with an internal blacklist, and 'MySEQ' is one of the 'blacklisted' processes. You would have to place a breakpoint on the client when it is scanning. On TLP servers, this happens about 5 minutes into being logged in. On Aradune's launch, it was within 60 seconds of loading in. Now they're checking that data on CSR request, and (unconfirmed) if an account is flagged for suspicious behaviors serversided, on initial load into a zone.
It is also well documented that Daybreak doesn't ban every offender at once. When they do a ban wave, they pick a select group of offenders to keep the ban reason a mystery. They may hold on to cheaters from one wave to another to further obscure the ban reason. It's a smart strategy to avoid people from immediately knowing the method in which they detected a cheat. The statement you just mentioned above is proof of that working.