> Until the highest-level engineers who agreed to implement this are personally held liable for some damages, we are unlikely to see change. No need, you just

> Until the highest-level engineers who agreed to implement this are personally held liable for some damages, we are unlikely to see change. No need, you just need to add fines that hurt and enforce them. GDPR usually doesn't ("we only want them to feel it a little bit, but it should not hurt"). Increase it so that a clear, intentional violation can actually bankrupt the company and you'll not see them at the large scale. A small player might still do it, but very few 100mm+ companies will risk it all and open themselves individually to law suits from share holders. Google gets a 50mm fine here or there. Their revenue is 45bn. That's totally worth it.