2 doesn't work since you actually have to list what you use the data for and keep that list up to date. You think large companies like Google didn't already try that?

> Which do you do?

Given that 2 goes out of its way to violate the law and make your users miserable I would suggest 1. But that is just the opinion of a non lawyer.