Malicious actors simply don't care about that though. They are either small fly by night operations that will just phoenix and restart under a new name, or they are huge like google, who have the resources to turn the fines and punishments into slaps on the wrist.
Privacy policies only hold honest operations to account, everyone else is free to do what they like.