Yes and no. If they get under regulatory investigation and are not in compliance with laws about storing minimal PII or deleting records that they said they deleted, then the fines are pretty bad. A lot of the regulatory fines scale with the annual revenue of a company, so even the tech giants can feel the pain.

The risk to the business for fucking around is pretty high. My guess is that some of this legacy behavior data just isn’t worth the risk.