search history is the most problematic, IMO, shows intent. But combine all three and you have a problem.

I think we need a new internet rule /law:

if it's online, it will hacked /stolen soon or later.

So they should not save most of the stuff.