The only time I saw a data breach changing user behavior was with LastPass scandal last year. Unless it’s literally the people’s bank account passwords that’s at stake, I don’t think most would care at all.

I agree, regulation - either enforced by the platform or authorities - may as well be the only way.