Considering each instance can have its own terms of service, this is a legal space that is largely untested currently. My thoughts are that the legality will boil down to "follow each instance terms", but it's an amazingly complex thing even there. And I say this even as an instance owner who thinks that bridgy should be explicitly opt-in either per-post, per-user, or per-instance.
Per-instance, to me, kind of makes the MOST sense for having an 'opt-out' tag in the bio -- each instance owner is then making their own users aware of the policy and can give them advance notice if they don't wish to be included. Just having a global "we can have your information even if you're unaware of it" policy is half the problem of the current tech industry snarfing up damn everything as if it's theirs to use, causing all the LLM garbage issues today.
Hell, the fact I'd have to end my wifi SSID in _at least_ two weird tag things, and one of them MUST be the last one, to avoid my wifi SSID, BSSID, and location getting snarfed by mapping cars (google, MS, etc) is just part of this. I have to take up limited characters in my bio for each service I want no part in? I have to make my SSID ugly just so a corp won't use info I didn't consent to them using? While I like the idea of being able to follow friends of mine who are on AT instead of fedi, and refuse to use fedi, it's not worth it being so open; I always figured there would be an opt-in mechanism, not yet more opt-out stuff.
C'mon like, haven't we seen how many times people offering only opt-out are shown the distaste for this? =/ 'bridge' or not, it's still technically a specialized service, it's not transparent just because things are duplicated both ways.