@mangeurdenuage Something like GNU Social conveys public information, so privacy is less of a concern. I can't imagine anything on my GNU Social instance that I don't want public.

Preventing data mining is difficult. You can restrict data to registered users and try to invoke the CFAA on them for unauthorized access (in the US), but other than that, data mining in the US and many other countries is transformative, and therefore fair use. In the case of federated networks, you're publishing (possibly a subset of) data to other services intentionally. There's no need to mine: you're feeding it to them directly.

If you're using a federated network to share private information, that's a different situation. People wouldn't want malicious NextCloud instances spying on their photos and calendars.