There are three reasons:
- once it's widespread - it's a standard (targeted ads, cookie tracking, SEO)
- we'd need a lot of infrastructure to track all the data recorded, where it goes, how it is processed, etc. etc.. And if a big company is caught.. they'll pay fines for being caught and let away to continue the same shady practices, as we have seen with privacy scandals at Facebook.
> ...but lots of terrible things people used to do got outlawed eventually.
That's the third reason - surveillance is evil and bad, but it will never be advertised as that. It will be something good and convenient with a surveillance as a side effect, similar to social media and smart appliances.
Maybe, I am just too pessimistic and you're right with: 'This process seems slow compared to a human lifespan'.
You just need to punish the people using the data. If you can then track down where they got the data from, that's a bonus. And if you can track down where those second ones got their data from, that's an extra bonus. But everything after the people using it is optional.
There's a _long_ list of unlawful things that are technically possible, sometimes trivial even. Only _because_ they are possible in the first place, are there laws against them. This process seems slow compared to a human lifespan, but lots of terrible things people used to do got outlawed eventually.