I propose focusing on the worst part: information collection on a massive scale. Even if it is not used right now by a spy. They can use what is collected at this moment against you at any point in the future.
Things like the DMA are addressing this well I think. The DMA aims to prevent sharing of data for things the user did not opt in to, that are outside of the product remit. So a hypothetical cloud storage provider could not use that data for ad targeting without getting an opt in from the user, but the user can still use the storage service.