Torts aren't handshake agreements. They're duties that the state decides that all organizations owe to citizens or other organizations, by virtue of existing, but which should be enforced by the party who is actually wronged. (This is what distinguishes them from "crimes", which are forbidden actions that the state actively pursues.)

In this case, Acton's not the aggrieved party. The consumer is - they could argue that Facebook's introduction of advertising and linking of user data harmed them in a way they had not agreed to when they signed up for Whatsapp, or that its purchase violated antitrust law and reduced consumer choice. But good luck enforcing that, at least in the US, where privacy protections are weak and antitrust regulators are asleep. It looks like the EU regulators actually did enforce it, and slapped FB with a $122M fine, but that's peanuts for them.

So while in theory you are correct, in practice, usually whatever punishment is given in a company doesn’t usually amount to enough to change the company and individuals are usually shielded from the consequences of any malfeasance....