It's easier to regulate one entity, harder to regulate many. People like to pretend that small businesses that hold people's data don't regularly get breached,

It's easier to regulate one entity, harder to regulate many. People like to pretend that small businesses that hold people's data don't regularly get breached, store passwords in clear, just sell your emails to spam agencies, etc.