Reading about all of this is so surreal for me as a German. I read about these "great" policy and all I can think is ... "so, they do the minimum required" .. what's there to praise? Then I remember how US (companies) tend to think about privacy and get very sad. Stronger penalties for anyone breaking relevant privacy rules cannot come fast enough.
Until a large chunk of congress, and probably the R chunk due to their privacy law stance, gets a TON of embarrassing stuff leaked to the public or better yet ‘shared’ when they weren’t expecting it... I don’t think anything will change. We won’t get real laws to protect people.
And a decent sized part of me says not even incidents like that would do it. It would just be blame-the-victim and you-accepted-that-policy and the laws wouldn’t really change.