Any tech site that provide private user data via an API needs to make sure that data is guarded like it was their own site, as if their own employees were accessing the data.
Maybe what's needed is a PCI-compliance standard or a HIPPA-act for general user data?