>I know we instinctively want to frame this as a privacy problem

How is that not also a privacy problem?