Why start with the only sector that isn't routinely harvesting and selling user data?
If they aren't doing anything wrong with the data, then what's the issue? They won't have to change any business practices.
If they aren't doing anything wrong with the data, then what's the issue? They won't have to change any business practices.