[renholder]

>...and receive no meaningful legal consequences.

This, to me, is the most pivotal part. Data was stolen in relation to you? Too bad, so sad.

>Collecting data on users should be extremely risky, even if they consent to it's collection.

The problem is that it's been so normalised that it's become pedestrian. It's the new norm and no longer risky because "everyone's doing it".

[nkrisc]

Correct, which is why we need laws and regulations that make it risky by shifting the cost of losing the data to those who collected and lost it in the first place, instead of those whose data were collected.