AI companies face fines for collecting personal data without consent