When someone commits a wrong, the punishment is in part based on the amount of harm. You might feel that adtech causes small harms, if you look at harm against an individual, but adtech folks harm billions of people, every single day.
If you're Mark Zuckerberg, Larry Page, or Sergey Brin, no fine is large enough to make you regret your life choices. The only way to punish billionaires who get rich off harming others is to take away their time/freedom, the one thing they can't just buy back. As long as corporate CEOs can't get jailed, crime absolutely pays in this country.
A large enough fine could literally take the company and thus their power away from them. A large enough fine could literally bankrupt the company.
The problem is simply that the fines aren't big enough.
A truly useful penalty would be to forbid them from owning any capital (directly, or indirectly like via a trust or index funds).
If businesses actually would have fines that significantly hurt the business (and not being able to deduct it from taxes, if they were unable to pay, they would have to close down) would absolutely help and would change the calculation from fine being a cost of doing the business to a punishment for illegal behavior.
Having executives be personally responsible for decisions and go to a real jail would be even a stronger motivator.
The current problem is that there's no real deterrent.
It doesn't need to be harsh, 3 days in jail with a review in six months to see if they've fixed it. Then an additional 3 days in jail. Pretty much any jail time would be adequate for typical C-Level execs. Also, not "Raped in the ass" prison time, just a mellow 3 days to contemplate their shiftiness locked in a comfortable room.
https://www.psychologytoday.com/us/blog/crime-and-punishment...
Very similar to trying to cancel a spammy subscription (but that's not mandated by law, so)
So who's liable in this scenario? Someone in the C suite? The coder monkey who implemented it? Someone in between? All of the above?
Unless I'm mis-remembering, the maximum fine under GDPR is a % of the total revenue of the company, so depending on the size of the company, this could result in bankruptcy of any individuals deemed responsible too.
Or to put it another way, is causing another massive economic shock the correct response to a dark patterns on websites?
Causing another massive shock to the stock market is the correct response here because nearly everyone is engaged in behavior that harms society and should be stopped. Also, the market will recover and really isn't that important. If a small proportion of actors were engaged in this activity then getting an industry compact or other token gesture might be good enough to correct it.
Or should we restrict the stock market only to the rich and powerful?