Fines for data breaches is one idea? If we want to disincentivize data hoarding, the main cost to data hoarding is data breaches, so we could perhaps penalize that.
This would have a different issue, specifically companies would no longer self-report data breaches, but it's just an idea. There are alternative approaches to getting to "don't track people without consent" that aren't a toothless stick by making it more expensive to track.
Here's my idea - no data collection without compensation. For example, you must pay me in advance 1 cent for the permission to access 1 byte of my personally identifiable information for the following month, whether that's stored in a cookie or in your own database or you access it via a third party (e.g. Meta). So instead of a "cookie consent" pop-up, I want a "cookie payment" pop up where the site will ask me for my payment details and say how much they'll pay me (again, in advance) for each of the options I can toggle.
This would have a different issue, specifically companies would no longer self-report data breaches, but it's just an idea. There are alternative approaches to getting to "don't track people without consent" that aren't a toothless stick by making it more expensive to track.