[grey-area]

Answering those questions in a public forum would be extremely foolish

Perhaps asking for questions was foolish?

And how many of them are actually in compliance?

If you're not in the business of selling customer data to third parties, it's not very hard to comply, just requires some discipline on how data is stored and who it is shared with, and a point of contact for enquiries about data.