Unfortunately for startups, I think that the only solution is to make it too expensive and complicated for the businesses to collect any unnecessary data. Like

Unfortunately for startups, I think that the only solution is to make it too expensive and complicated for the businesses to collect any unnecessary data. Like dealing with credit cards, no devs in their right mind would want to process CCs by themselves because it's such a huge risk and pain in the ass to be fully PCI compliant. We all outsource that part of the work to 3rd party processors because of the regulations. Why not do the same for the personal data, make it a very high risk for the business to process it directly and the majority will avoid dealing with anything that is not absolutely needed by their business model.