And I've never seen a single stalker-corp ("data broker") executive serve prison time for failing to delete data that they claimed was deleted.

Either that has literally never happened, or there's inadequate auditing/enforcement, and I don't consider the former to be plausible.