C - control when you collect it.
R - read what you have on them, and know how you read it and/or share it with others.
U - update it, e.g. when it is wrong.
D - delete it.
Most users just want non-hostile defaults, but all users should have CRUD-control.
It has been great to see Apple, for example, move more towards better awareness and defaults for C, but by and large the internet is still a mess of hostile defaults, opaque privacy statements, and no way to know that this weather app is selling your location to advertisers when they could've just asked you for your location, if they wanted to be a weather app.