Even in the US, the GDPR means companies have to at least pretend to care about data privacy,

A company I worked for a few years ago quite literally “noped” out of GDPR compliance by spinning off all its overseas business into a new company and walking away from the market entirely. That was a pretty big sign for me that the company was a piece of shit and when I started looking for a new job.