They should but rarely do and even if a tiny victory like GDPR is won, it's immediately dismantled by big corps. Facebook hasn't been fined any significant amount yet it violates GDPR every day. As it stands right now, the average user has no privacy.

Just try this: Use a default browser without adblocking/tracking protection etc. for a week and look how the ads are targeting you more and more. That's the internet for the average user. We just don't see it as much because we default to protect ourselves.