In the long term we need HIPAA style regulation for all kinds of personal data: friend graphs, behavioral histories, private messages, and especially things like location data or voice assistant audio samples.
Leak such data without explicit customer consent? That will be $10,000 per incident. So if you leak 100 data points of someone's location history that will be a $1,000,000 fine.
Explicit consent must be per-incident as in "YES I give my consent to send this information to <recipient> for purpose of <...>."
That would incentivize strong security practices and even more importantly dis-incentivize data hoarding beyond what is needed to provide a service. Hoarded personal data would be a gigantic risk and liability.
Leak such data without explicit customer consent? That will be $10,000 per incident. So if you leak 100 data points of someone's location history that will be a $1,000,000 fine.
Explicit consent must be per-incident as in "YES I give my consent to send this information to <recipient> for purpose of <...>."
That would incentivize strong security practices and even more importantly dis-incentivize data hoarding beyond what is needed to provide a service. Hoarded personal data would be a gigantic risk and liability.