The issue is: We can't prove it either way. We can make law which increases the risk if they are uncovered and hope they abide to it (see GDPR and California Law for attempts in that direction) but a prove is hard.

At the same time we see the incentives, and the incentives are to collect and analyze things.