2) Customers don't really seem to care. There has been no major protest in any country over personal information getting leaked, it doesn't affect most people on a personal level so it just doesn't matter.
Unless you think AI companies should be excused even from obeying the law, because that slows them down too much, which is kind of ridiculous