Most ideal: make personal data a massive business liability, such that personal data is rarely even collected, let alone stored. This is much more possible than people believe (even making exceptions for current regulations like KYC). Does the local pizza place need to know anything more than my order, where to deliver it, and that the money arrived in their account?‡ Does a hotel or airline need anything other than a confirmation code to hand over the room key or seat? And yes, this may kill off or force pivots from businesses that exist today solely to spy on us—that's the point!
Only okay: personal data isn't shared or sold to third parties. Businesses can collect data on their own users, but it can't leak beyond the corp firewall or else big penalties come into play. Only okay because leaks are almost mathematically inevitable, so there will be constant lobby pressure to relax regulations, or enforcement thereof.
Not good: personal data can be collected, retained, and sold by basically all companies, and the penalties for unintentionally disclosing those data are just slaps on the wrist. At least it can't get much worse though, right? Right??
Businesses will adapt to any set of regulations—it's up to us citizens to demand the laws we want.
‡But what about remembering your favorite orders, or saving customers time by not entering their info for each new order? One options is to let them bookmark the page, so their device can get back to it easily.
We saw how eager people were to install Google Analytics on their websites. They don't care what they do to their users.