If you collect user PII & get hacked, you should be obligated to pay for the damages. Specifically, covering the user for identify theft monitoring for 10-15 years.