> Now imagine which percent of restaurants would fail if we also included failures to comply in other subjects?

And your point to all this is?

> No, they will most likely never be inspected because there are far too many businesses to control and thus will never implement or fix their practices.

Funny how it's not far too many for the heath inspectors, and tax agencies, and ...

> They have just as many rights to do it as large companies

Exactly: zero. Edit: that is, zero right to collect any personal data beyond what they need for the service. And definitely no right to siphon and sell it to others with reckless abandon.