@thatprivacyguy I understand.
However, I do see, unfortunately, lots of people throwing laws around to try to stop something that is completely legal but they personally dislike.
With that being said... You haven't really justified anything. I believe you have a lot of experience and know very well what you are doing: good for you. But I still do not understand why you're framing it this way.
In particular, I would like to know exactly how they're doing this, on a technical level, since you mentioned you know perfectly well (and I only have a vague intuition, admittedly).
I may not be as academically achieved as you are in regulatory fields, but I do have a CS degree, and more than a decade working with Internet-connected systems, specifically in the areas of computer security, which of course includes handling PCI, PII, and GDPR data in a secure manner. I am sure I would be able to understand how YouTube has implemented this on a technical level in a way that contravenes the law.