SOX compliance is not about data security though. It's about making sure financial fraud isn't happening.

There isn't really a cybersecurity law or framework with the teeth of SOX or as widely and thoroughly implemented. Maybe if there was they'd be more valuable.

Really think we are due for the black swan event of user data — payment info, explicit personal photos, private conversations, etc. The average person just has way too much implicit trust in these large corporations who for the most part do not take their privacy obligations seriously.