How about adding third-party analytics integrations that compromise your visitors, tracks them around the web, and fail to protect that data properly as the analytics company gets acquired by another entity?

Stop saving PII for profit/exploitation reasons and you're in the clear.