I would argue this isn't the case. For many people it is out of sight and out of mind. They don't realize what's happening.
I came to this conclusion after talking with people about it. Numerous people didn't believe it. I had to show people documents and articles for them to believe me. Most of the people I've spoken with do not like this behavior and would rather not use a service or pay for it if they had known.
The average person is unaware. That does not make it ok.
This is where the line is drawn for most - if people from Facebook, Amazon or Google look at information other than machines. Totally fine if it's just a computer with a strong law like GDPR safeguarding it.
From my conversations with Googlers at least, it does seem they're extremely careful about insider threats.
You can easily find articles about sufficiently low-level drones getting fired from Facebook for snooping if this is an authentic query.
If you have trusted friends in tech, you can ask them even better.
Any actual data other than anecdotes?
If your business can't survive by charging a fair price for the service it provides without stealing data, then it shouldn't exist.
For many, many people, that is _fine_.
The real issue I see here is how this law is written and how we're interpreting it. If the law makes it so that people who want to opt out of free internet services because of privacy concerns are free to do so, then we're all good. If the law is written such that people who want to avail themselves of free services in exchange for their data are no longer able to do so because that business model is broken, then I see a lot of problems.