So, we complain to a regulatory body, they investigate, they tell a company to do better or, waaaay down the road, attempt to levy a fine. Which most companies happily pay, since the profits from he shady business practices tend to far outweigh the fines.
Legal or illegal really only means something when dealing with an actual person. Can’t put a corporation in jail, sadly.