> The issue is there is too little repercusions for companies making software in shitty ways.

The penalty should be massive enough to affect changes in the business model itself. If you do not store raw data it cannot be exfiltrated.