I agree that GDPR-style privacy legislation is the ultimate solution, but unfortunately due to the international nature of the internet that sort of legislation will have difficulties until at least (1) the USA passes some sort of GDPR-style federal legislation, and possibly (2) GDPR-style privacy protections become part of international treaties going forward.