The only solution is regulation with actual teeth. GDPR was a start but enforcement has been weak. Companies need to face real consequences for privacy violations, not just slap-on-the-wrist fines