On-chain analysis should be unlawful in the European Union, and this is why

Under the GDPR (General Data Protection Regulation) indiscriminate web scraping, which involves techniques used to extract data from publicly available information on websites (such as texts, photos, videos, etc) is unlawful.

There have been many investigations where authorities fined and stopped those who were scraping in an indiscriminate way. Facebook was actually fined for more than $200 million because it failed to prevent web scraping of its pages. The same goes for ClearviewAI, which was fined all over the EU and UK as well for illegal web scraping of photos from social networks and public websites to train its AI algorithms.

On-chain analysis is no different from web scraping. Companies acquire massive amounts of public data (which is personal data) and then feed it to their system to try and find patterns for many different reasons. This especially applies to the anti-money laundering context, since it's also a criminal issue.

In western countries nobody can be subject to indiscriminate surveillance without at least some evidence that they might be involved in criminal activity. This is the founding principle of surveillance in criminal law, especially in europe. This thesis is also supported by the European Data Protection Board, which in 2022 confirmed the disproportion of broad AML surveillance activities in the crypto sector, as proposed by the European Commission.

So, mass on-chain analysis for purposes of anti-money laundering and address profiling should be considered unlawful under the GDPR.