Not wanting extra regulation and associated costs does not mean a business intended to not protect their users privacy.
Some value it until they hit XXXXXXXXX amount of extra cost. Some only value it until they hit XXXX amount of extra cost.
Most probably only value it as much as they're forced to.