This is how giant bureaucracies work. A large number of disconnected sources of authority. Esoteric legalese–often not actual legislation–that mandates cross-jurisdiction compliance.

Whether it's legal or not doesn't really matter... only very large players will have the resources to challenge these requests. Everyone else will simply comply for fear of being ground to dust by the legal system.