It's almost has if big companies were regulated but personal websites were not.

> when some random small website

It could be some random website. It could also be a 3 letters agency website training airport security face detection, a social engineering website, a random website storing images in a public s3 bucket.

> The internet has reality distorted everyone's perspective.

You give all your personal / biometric info when you get a new passport. If some rando guy were asking for your biometric data in a street would you give him ?