The intent behind spyware and Equifax's data leak are not comparable.
On one hand we have companies selling spyware for unlawful data collection (like wiretapping). On the other hand Equifax collects the data through partnerships and data-sharing arrangements that (whilst opaque to essentially all consumers) is generally well-regulated.
GDPR, the APPs and CCPA may curtail another Equifax incident but outright-illegal data collection needs a different solution.
Equifax survived leaking all that data. That still amazes me. Roughly 1 in 3 Americans had their PII leaked and they suffered minimal fines. Minimal in the fact that they certainly haven't been impacted operationally. If the laws can't punish that level of breach, they aren't going to punish the small potato sized ones either.