Laws aren't the fine step, but the biggest one. You'd be surprised how many companies comply without any coaxing once they are made aware of new legislator.
And for those that don't: we now have a legal channel to report them to. Having the government enforce its laws is more effective than trying to arrange a general boycott.
They do, when they are enforceable and the punishment for violations is credible. But in the tech world, punishment for things such as privacy violations and market abuse most often amounts to a trivial fine, and business then continues as usual.
Laws don't prevent firms from doing illegal things. Without public awareness, nothing will change.