These policies stem from elected officials, as far as I can tell. How else would you propose they make policy decisions?

My impression is these decisions are related to genuine concern about how tech companies collect and use personal data.