SSIDs aren't private information, but it does seem like the natural privacy of scale should apply. I'm ok with people who are nearby being aware of my SSID... does that mean it should be ok for Google to collect millions of SSIDs to use in a profit-generating positioning database?

It seems like it should fall under a regulation similar to photographs. You can take photos of me in a public place and do whatever you want with them until you're using my likeness in a commercial capacity... then you need to ask me first. Opt-out isn't enough, it needs to be opt-in. If that doesn't work for your business then too bad.