Boycotts rarely work. We'd be better off raising awareness of Facebook's misdeeds and using that to awareness to build a grass roots campaign for policy change. In parallel with that, we should be having a discussion about what sort of legislation would be most effective at curtailing Facebook's (and everyone else's) bad behaviour.

Or maybe, people could choose not to use services that don't respect their privacy if they care about privacy? Surely, that's not expecting too much from people?

No, it's just mean almost everyone find it inline with their ethics but not yours.