I think you’ve just asked the question “Why doesn’t the US have information privacy laws?”

In any case, if an instance owner did this and they had at least one user from the EU, they’d get sued into oblivion. Meta, Apple, and Google constantly get hundreds of millions of dollars in fines over stuff like this.