What the US needs is a regulatory framework like GDPR that incentivizes this sort of behavior. Private data should be considered a liability, not an asset. Taking less and keeping it private+secure should be the default -- not the exception that needs calling out.

Kudos as usual to Mozilla for going out of their way to promote these principles.