As is often the case with these things - declaring high level rights is easy - practical enforcement is the hard part.
It is very hard to make someone understand this if their income and power depends on not understanding it.
Some data is important to collect - I expect my bank to keep a record of my financial transactions! I just don't want them to sell them on, or use them for services I didn't sign up for.
And an 'opt-out' system isn't sufficient - it needs to be an opt-in system. An opt in system that isn't by a forced game of yes/no bingo - it has to be one where the customer has to take the initiative.
You don't get bombarded with extra stuff being put into your basket at the supermarket checkout and then asked a series of 20 questions about whether you want to take the extra things. You shouldn't with digital services either.
Now the hard part is that legal definition between what's the data reasonably required for the service and what's taking the piss.
I'm arguing one way to define that is whether the data use involves joining dots between transactions in a way that's not required for the immediate transaction or service.
Laws are all about balancing interactions between parties. If you lived on your own there would be no need for laws.
Laws police the space between people - where your right to freely do X, impinges on someone's elses right to be free of y.
Agreeing and defining that balance in a legally enforceable way is often not so easy as it first appears.
But let's be clear - I'm not using it as an excuse not to try.
I believe the problem might rather be, that there's a lack of clearness and awareness when it comes to how privacy does apply to online matters.
Even technically knowledgeable people are often caught completely off guard by how much you can actually glean and deduce from very limited data. Most people wouldn't believe how revealing some seemingly innocuous data can be, when you collect enough of it.