yes, that's a possibility, but we're far from server-side GA implementations and we do have an option to make a data request to figure out what companies are doing.

If they get caught lying (and that tends to happen in the end) that's another violation that is taken seriously nowadays.

For example, my e-mail server started picking up messages from DELETEDmyname@mydomain.org. Making it pretty clear a company did not respect my wishes to completely delete all data and user account references. They simply changed my email in the DB.