Unless there’s a legal or regulatory compulsion to ensure privacy, it’s unlikely that companies like Facebook will do so