Unfortunately, normal people don't know how to turn them off or use the https version. Google could do a lot of things to make this easier.

The best would be to just prevent ad networks from collecting this personal information altogether. The only reason I've heard against doing so is that webmasters need search terms for SEO, but they can get them via Webmaster tools.

Failing that, they could make a setting in the http version that turns off the headers. They could also make a setting that defaults to https. And they could make https easier to get to. Currently you can't even do https://google.com/ (you have to type in www.)