Shift liability to those who store and sell data. They get full economic responsibility for fallout of breaches of data that is retained past the time necessary to complete the transactions. If they sell the data then they hold liability for all breaches of downstream parties as well. Require them to carry insurance against breaches.

It would completely destroy the data brokers and targeted ad industry but the world would be a better place as a result. Also not going to happen but I can dream.

Finance follows the risks and the users.

We'll probably never convince end-users to "vote with their feet" and use Privacy-focused products. But we can absolutely, through legislation or just precedent, raise the Risk profile until it's better to leave the ad revenue on the table and run a private service.

Gotta be able to stop fraudulent payments while maintaining privacy before ecommerce would have any interest in adopting a more private system.

I've worked at plenty of companies that have no interest in tracking their customers but still need to be able to pin IDs to credit cards, etc. to have any hope of stopping mountains of fraud.

We've already moved away from sites storing credit card information, because the risk of storing it yourself is simply too high. We need to make the stakes higher for other personal information.