It'd be great if this could be codified in a proper regulation (that also has to be obeyed by US companies, not just Chinese ones).
But that's hard - it's easier to demand that private corpos play the enforcer (and corpos themselves were dumb to even get themselves into a situation of playing the moral and political arbiter).
Privacy breaking apps must be thrown out. However, this mustn't be decided on the basis of hearsay.