> but costumers can't take their data back.

For a US company, yes. For EU companies, the EU privacy law says you can only use the data for the original purposes, and based on what the person consented to. You can't grab all data (since that's overbroad), and "consent" can't just be "click through on legalese".

If you're concerened about privacy, don't use US companies.