That's the problem, right here.
Not that entities are selling people's privacy. Bad guys have always been there, and will always be. But usually people want to act against them.
In this situation people don't want to. We got a very sudden outrage out of sheer media amplification effect. It will fade. And they will go back to trading what's important to what's convenient.
Some of this is genuine indifference to the problem, yes. But I think some of it is a lack of perspective.
After years of sweating tech privacy issues, it's very easy for me to say "oh, they track app usage, which means they track app opening times, which means they can probably tell when you go to bed every night based on the last time you open Twitter." Or construct a hundred other scary (and accurate) stories about how this sort of data can be used to build whole-life profiles of people.
Outside of tech, it's not so obvious. "They track which apps I open when, and said it's to help improve battery usage. What's the big deal?" And of course that's also true, this is useful data for innocent purposes like "predicting what you'll reopen next to expire that from memory last".
But my concern is that there's an enormous gulf between showing people what's been collected, and how it's used. This article makes a bit of an effort, but it's still far short of the sort of example narrative that actually catches people's attention.
Back during the Snowden stuff, there was a lot of talk about three-hop collection. And I think basically no one cared, because it's such an arcane description. But somebody made a tool (which, damn it all, I can no longer find) showing how location + call data at three hops could create a false-but-convincing narrative that someone was a terrorist. I showed that to a couple of family members, and suddenly they were way more concerned with the topic.
It's not easy, I think this is a losing battle and I'm not sure how to change that, but I think people do care when they have useful context to work with.
Most of these people don't even know how the technology works. Enabling firewall makes them feel secure because it shows them a Green tick mark in a green circle. A file shred application is good to them (if they even care) because it shows an animation that feeds a file to a shredder and breaks them into pieces.
They are never going to agree that they can be manipulated this way. Oh, and some people feel website x is secure because there is a green lock symbol in the URL bar. Some are more secure, because the green bar is a bit longer.
Except when all other measures have been exhausted, we shouldn't be so quick to run to the legal system clutching our ban hammer with our perceived state of righteousness.
Another problem I often see (not here, just saying in general) is how false equivalence is constantly brought up. Oh, so we should just let companies poison food or build insecure cars or whatever. I hope that with user data we can be more reasonable in how we legislate it and at least try to realize the unforeseen costs on the "good guys" vs the "bad guys".
Apple is a bit better (less-worse) on this. They do log many things in the background, and hopefully stopped (as they promised) to upload everything on every sync you do.
I think that's a point to take home. Users know that Google looks at their "location information". In their minds, it's to provide relevant weather info and whatnot. Seeing it aggregated in this way makes you realise that you actually are sending your entire life to Google servers.