This assumes that apps and sites provider any toggles to turn this off.

Of course they don't. And those that do will definitely remove them at first opportunity.

The only hope is regulations like EU's DSA, but those are only as good as enforcement.