Steep fines are barely a speed bump to either a profitable business or a scammer. They take years to actually get implemented, don't survive bankruptcy and get reduced in court.
Jail time. Mandatory. Zero room for judges and juries to go easy on the perps.
Even this does not stop white-collar crime, but it maybe slows just a little bit of it.
Are you going to buy shares in a company who’s entire worth is derived by it’s user data when it turns out that a significant but unknown amount of that user data is actually a very expensive liability?
There’s always going to be someone searching for loopholes, like anything, so keep it unambiguous and straightforward.
... but I feel like it isn't the ideal solution. I don't think we should make the perfect the enemy of the good, but what I'd really like to see is that people own their data about them.
I should be able to figure out what vendors have data about me. I should be allowed to be forgotten. There should be severe liability if they don't forget me.
I should be able to contract away my data, but in return for a real benefit, and that shouldn't extend to sale / redistribution.
I don't buy anonymization. De-anonimization is too easy, too good, and progressing too quickly.
Make a law where if you ever sell a minor’s data, regardless of whether that minor lied about their age or agreed to a contract (wouldn’t be binding!), then you face steep fines. If you’re found buying data belonging to a minor, also steep fines. If you buy and then de-anonymize data belonging to a minor, really steep fines. To collect and hold data that may belong to a minor, you need to justify it (like GDPR).
Obviously this doesn’t scale for aggregators, advertisers, basically SV, which is the point.
A restaurant is responsible if they sell booze to a minor. A store is responsible if they sell cigarettes to a minor. Serving a minor that lies about their age does not get you off the hook!
Problem solved. User data is toxic. You won’t want to hold onto it for any other reason than a legitimate use.