I believe that is why people made such a fuss about the GDPR allowing courts to slap companies for up to 4% of their worldwide annual revenue. Whether or not that full extent is ever brought to bear against particularly megacorps is a different question, but at least medium-sized companies will probably avoid repeat offenses. I don't know how Meta felt about the 1.2 billion ticket either, but I can't imagine they just shrugged it off as normal business expenses.