> We need PII to be so toxic that companies run screaming from the liability
This is how healthcare workers used to treat health information protected by HIPAA, but it seems like the big corporations don't really even care about it. Nothing ever comes from violations besides slap on the wrist/cost of doing business penalties. You can't do anything without waiving all your rights, granting permission to be recorded, granting permission to use your photograph for anything they want, allowing your recorded audio to run through AI for transcription (and whatever else they want to do), granting permission to share your data with their partners, associates, and some vague description of "anyone we decide at a later date". That's before you can even sign-up, receive care, have a service rendered, enter into a business establishment.
There's pages of fine print documenting it all in vague terms that ambiguously safe guard the provider from any liability, but half the time, you don't even get to opportunity to (not) read it. It's just a link to go elsewhere and (not) read it. They add as many steps between you even reading what rights you're giving away, so that even the people who had a mind to do so would get fatigued, and they make you do it while there are people queuing up behind you, or you're almost done with your purchase/subscription, etc.
Everything is so consumer hostile (and expensive in America), but no "better" service can swoop in, because the established Big corps get to break all the rules or can afford the token penalties to give them an unstoppable market share no honest disruptor/competition could ever overcome. On even ground, no competent person would choose to be abused by our resident monopolies vs a reasonably similar priced local upstart, and a lot people would even pay (a little) more for a better experience/product/service.