We need blanket minimum privacy protections at a national level, and they should treat internal repurposing of data the same as third party sharing.

Since all major players in our industry have shown they can’t be trusted to curate large collections of sensitive data, inclusion in such internal datasets should be opt in as well.

Dropbox is a poster child for “this should be E2E encrypted”, so, yes, I’m arguing they should get your explicit opt-in before they are allowed to store unencrypted data or escrow keys on their end, and that the opt-in shouldn’t be required to use their services.