Not every state(, country, province, region, whatever) has laws that restrict or prohibit this kind of activity. A complaint to a public prosecutor may not be a good option for many people, especially in the US which historically has had very permissive laws about how corporations can handle user data (with some exceptions like the CCPA, though TBD if that legislation would do much here).