Whether over months or years, they have certainly gotten worse. It is a race to the bottom or to 1 micrometer above the legal red line if one should ever be established.

CFPB and FTC talked about it: https://www.consumerfinance.gov/compliance/circulars/consume...

Summary of comparable talk in the EU: https://www.insideprivacy.com/eu-data-protection/the-eu-stan...

Down in the details, it looks like there has been enforcement in individual cases, but it obviously was not enough to stop the flood.