The largest effect of data privacy regulations is on self-policing behavior. Every person at every hospital in the US knows what HIPAA is and is at least aware

The largest effect of data privacy regulations is on self-policing behavior. Every person at every hospital in the US knows what HIPAA is and is at least aware of it and potential impacts. There is training, consideration is given to it with respect to IT decisions, etc. It is a very different set of behaviors than pre-HIPAA. Same with GDPR, you very clearly see large corporations at least asking: "Do we need this data?" and there's a patchwork of state privacy laws (CCPA being the most prominent) that are in effect. Case in point: Illinois has really stringent biometric data laws that include facial recognition and I would not be surprised at all if they were right now preparing for legal action against Clearview for violations.