I think most laws should look reasonable from the common-sense viewpoint. And when they don't, there should be a serious explanation.
Corollary: a secure notification should consist of a link with a random number token which opens the real message via an authenticated API on an encrypted channel. Would look a bit weird though. iOS at least has silent notifications for that.
That's why the surveillance capitalism business model is so dangerous. If you horde user data to make ad sales more profitable, you put your users at risk.
If app developers want to pass customer data in notifications, the data they are passing should be encrypted so that Apple (or Google) doesn't have access.
You can't hand over what you can't access.
As they say in Apples developer docs:
> Important
Don’t include customer information or any sensitive data, like a credit card number, in a notification’s payload. If you must include customer information or sensitive data, encrypt it before adding it to the payload.
You can use a notification service app extension to decrypt the data on the user’s device.
https://developer.apple.com/documentation/usernotifications/...
- Former NSA General Michael Hayden
Avoiding the collection of user data in the first place (if it's possible) is exactly the correct approach to user privacy.