But not just for adtech. Holding personal data needs to be so dangerous that most companies won't do it unless they absolutely must. That goes for credit card companies, "loyalty card" programs, magazines selling your contact info when you sign up so you get junk-mailed for 100 other magazines a week later, credit agencies. Make a major leak trigger such a large fine it's a death sentence for most companies, and give those harmed first dibs on company assets. Watch the market take care of the problem as insurers, creditors, and investors do their stuff in response to that change.