I think that the core issue here is what "privacy" means to people. Data about you can be hard to quantify, and in the digital age there are plenty of reasons to collect certain kind of data.
For example, I wouldn't care much about my aggregate step data from my phone or watch being used to observe walking habits or popular walking routes in my city, nor would I mind much about my aggregate location data being used to observe store patronage in my city. I prefer to opt-in to these things, and have an understanding of the data I am sharing, and who I am sharing it with, but as long as it's aggregate, non-identifiable data, I am willing to part with it and still feel that my privacy has remained intact.
But as you say, people don't value privacy until they're hurt, and I think that's a really good place to draw the line. If the data collected about me can be used to hurt me specifically - to target me or expose sensitive information about me as an individual - then my privacy has been violated.
The recent Grindr controversy is a good example. If people opt-in to data sharing in the app, and the app provides clean, anonymized data to their partners that only reveals aggregate trends, then the privacy of individual users is still maintained. But since the data that Grindr sold was enough to out a clergyman and expose the specific gay businesses he was a patron of, then they clearly failed to preserve their users' privacy. The data they sold was enough to target and hurt someone individually.
The big issue I see is that most corporate data-sharing agreement put some of the burden of privacy of the recipient of the data, with the expectation that the data be handled in good faith and NOT be used to target people or mine information about specific people. The burden should lie entirely with the seller of the data to ensure that no privacy-violating data could be inferred from the data (including if combined with other publicly/commercially available datasets), and if they cannot ensure that then they should have no legal right to sell it, because there's no way they can ensure that it will be handled in good faith.