GDPR compliance is a big problem in this space, there's no GDPR exception which would allow you to legally collect this data in the EU. (Unless you limited your collection to whitelisted A/C)
Right now every single player in this space is operating illegally, but it'll probably take years before data protection authorities will start to crack down.
Is SDR accessible through the internet a violation of GDPR? Hard for me to understand why relaying ADS-B would be different (considering the sdr data is inclusive of the ADS-B data)
I'm going to guess that collecting / organising the data is a problem.
Data Protection laws, and I believe the GDPR is the same, aren't interested in just stuff you've got, for example if you write a blog, and you mention that you saw Jim at the weekend and his sister is apparently pregnant, these laws do not consider that you've got a database there with a single row ("Jim's sister" "Pregnant") which needs to be treated as PII and have Subject access requirements etc. You're not really collecting pregnancy status data about women, you just have a blog post.
Whereas if I build a scraper, and I search thousands of blogs and correlate stuff to build a Postgres DB with "Jim's sister" "Pregnant" as one of dozens of rows, that is the sort of thing these laws care about.
So I can imagine that likewise "Here are radio signals I am receiving" looks like public information, no big deal, whereas "Here is a database of records I gathered by studying the past 24 hours of radio signals" is different.
Because the data can often easily be tied to specific people.
You also can't set up a camera on the side of the road and store peoples registration plates and times when they drove past.
You could also easily track cellphone IMEIs and locations in the same way these services track aircraft, that's not gonna fly either.
Obviously you'll be completely fine if you only store data on commercial aviation, general aviation will pretty much immediately veer into GDPR territory.
Right now every single player in this space is operating illegally, but it'll probably take years before data protection authorities will start to crack down.