Sure, but that's getting too far into it. Not that you're wrong though. The point was, the people that make the thing never/rarely get punished, but it is the individuals that get the hammer. If websites get fined for running the evilCorp SDKs, then the problem would be more effectively solved by going after evilCorp for providing the SDK. If there was no SDK nor reward for using it, the websites being fined would not have needed to be fined. Trying to scare people into not doing something is much less effective