> majority of big tech companies have been treating user data like radioactive waste for 10+ years.

They're collecting more than ever.

This has not been the case at any of my past employers in B2C...

There was a fair amount of scrambling to get GDPR/CCPA compliant, but even that was done largely with a prevailing "ah, this is a defensible thing to store, make sure you can annonymize it or scrub it if needed" vs "stop storing this."

Starting with the ones that are most popular in the US, "Big Tech" usually includes:

- Google - Gmail and Maps contain massive amount of PII, Photos contains all sorts of other sensitive stuff, and they have not treated those aspects of those products like radioactive waste

- Meta - Facebook has a real names required policy even. Not a lot more needs to be said there, I think.

- Amazon - Nothing I've seen about trying to move away from how they need your name/address/payment info and all. If anything, more and more geographic targeting and such.

- Microsoft - Now you need to tie your local Windows install to their cloud services, not moving away from collecting user info. Also moving towards subscriptions which means PII and payment info.

- Apple - cloud accounts + email + payments + subscriptions all here too. Getting into banking-type services, that's leaning into PII...

- Netflix - more and more PII (IP tracking and geolocation combined with things like email and name) to fight account sharing...

Which ones were running away from it, exactly?

> suddenly there are millions of euros of fines headed your way

I'm not sure about that. As I see it, there is no business case for treating PII carefully: security costs money while leaking PII costs nothing and has no repercussions.

you must be living under a rock, mutable user data like usage habits is being collected at increasing levels

But then why do they want to sniff after everyone?

Storing all that information is cheap nowadays. Any state agency may be happy to get more information about The People.