Shouldn't this involve lots of penalties? This has the potential to change/ruin lives drastically. A prudent consumer never trusts what the companies say nowadays. However, that shouldn't absolve the company of falsely claiming private product when it isn't so.
The GDPR is proof that terms of service isn't exactly a flawless legal barrier. You can't state in a contract that "If you use our service we get to sell your personal life away" because illegalities and rights infringements cannot be inside a contract to begin with.
GDPR is nice on paper, I'd like to see it actually enforced as its been written. Seems like strong words and weak teeth so far. However, most companies are more concerned with hockey stick charts and are willing to ask for forgiveness later in terms of all things privacy related. I wish it weren't that way, but Ive yet to see that happen successfully.
It's true that it's a reasonably good practice to assume that databases will be leaked. That doesn't mean that when a company loses control of private data that the company holds no blame.
American package warnings just show you how litigious the society is. Road signs. Government agency seals in front of home movies. Cookie popups on websites.
All of it gets filtered out by your brain and loses effectiveness immediately.
One has nothing to do with the other. If I run a roof repair service and give you a free job that doesn't mean you cannot sue me for damages when rain starts pouring into your living room.
