Do most people not care, or are they simply unaware of what they are giving up and the real impliciations of the social web?
For example, we all know Facebook is huge, and many people give up all sorts of personal data to the company running it. And yet, on several recent occasions when Facebook have made changes that they were demonstrably technically capable of making and arguably within their legal rights to make, but which diminished the privacy of their users, the outcry from the user base was substantial and in some cases they gave up and essentially reverted the changes.
That was basically a PR/marketing move by Facebook: when you rely on critical mass of users in the way they do, you can't afford to upset people en masse so that they start to drift away to a rival service. It wasn't forced on them for technical reasons, and relatively few countries raised significant legal concerns about the privacy implications.
I wonder whether users would be similarly upset if they realised how much of their "private" data has been shared with other parties over the years, and where it has wound up, and how many people have wound up defrauded/stalked/otherwise genuinely damaged as a result. I think there's an element of "It can't happen to me" at work here, and my biggest worry is that as we've seen recently with organisations like Sony, corporate complacency and denial are no substitute for real security and privacy protection when Bad People decide to come after you.
[Edit: I would also be interested in proper studies if anyone has links, but only if their methodology is sound. I am reminded of the "study" last year about attitudes to the virtual strip search machines at airports, where apparently 90% of people in my country said they supported them. When asked with different wording in another study, not conducted by an organisation with ties to making the machines in question, it turned out that many of those people really meant that they preferred the hands-off abuse of the machines to being physically abused during an aggressive pat-down, which isn't the same thing at all. Privacy studies are all about how you phrase the question, and those with vested interests are very good at that sort of thing.]