If they are knowingly doing something that can cause harm and not properly warning users of it, then they should be held accountable. However, users shouldn't be prevented from using a service just because a government agency doesn't like it. That's a delicate balance that preserves individual freedom to choose while still providing some reasonable amount of protection.

One critical piece here is requiring companies to safeguard any data they collect, not allow them to sell/make it available to other entities w/o express permission and fair compensation, and to remove any data they have collected upon request. That alone helps mitigate the worst of it.