More generally, I think we need to approach discussions about data collection from the perspective that data being about a person doesn't mean that the person owns that data. Here's what I mean: The sort of data we're talking about is personal (read: "individual") merely in the sense that it is about persons. However, it's social (rather than personal) in its origin. For example, the list of my commercial transactions isn't originally (fundamentally?) data about my person. Rather, it's data about a social fabric of which I happen to be a part. So, personal data is not originally personal.
What's the significance of personal data being fundamentally social (by way of its origin)? Well, I would contend that it means personal/individual means of managing personal privacy are ultimately insufficient; your data (while it is about you) doesn't naturally belong to you. Therefore, my takeaway is this: If we want to make personal data (i.e. data about persons) practically personal (i.e. give persons control over their own data), then we need social mechanisms to protect it. My aforementioned point, about the insufficiency of personally-undertaken measures, is corollary to this.
For better or worse, it seems like most people these days equate "social mechanisms" with "regulation". However, there are in principle other social bodies (both formal (e.g. unions or guilds), or informal (e.g. various social movements)) that could be sufficient to make personal data truly personal. However, I'm unfortunately skeptical of the efficacy any non-governmental body could be when dealing with this problem. But that's beside the point.
[0] https://www.vox.com/2018/4/20/17254312/facebook-shadow-profi...
True. And if not using the services meant that those companies wouldn't spy on me, then I would have no complaint -- I already don't use their services. But it doesn't.