You don't always have the choice of just up and go. I developed a system for an american startup that gathered everything it could get its hands on through their Gmail accounts. Did I think that's unethical? Yes, but just quitting wasn't an option and it was perfectly legal. I switched to a new company when I could afford it and am now much happier. But suggesting to just quit the moment your company behaves unethical is a little optimistic.

It's not perfectly legal if you ever do it to an EU user, now. This is why GDPR has some upsides -- it changes what was formerly just unethical into being illegal, which means that we as software engineers can push back against it more strongly.

We actually developed a GDPR module for about three weeks to catch that case. So we are legal again, since we provide all the tools you need to delete your data.

What "appropriate authorities"? Shouting into the void at some google user forum?

Hacker News.

I'm only half kidding. I once had an issue with a Google product that they only fixed after ranting about it here.

Sadly this isn't against the rules. Probably because the users still can go to the app-store and give you a bad review, haha