That's not been very effective in tech recently, has it?
People have control over whether they enable the surveillance capitalism grift when they are used as means to an end. They can make this business model proliferate much less, so that much fewer companies are built around it, and other business decisions are relatively more profitable. We can all not use apps that track us, clear our cookies automatically when the browser closes, use E2E encryption in communications, and so on. And yes, many people can also not shop at Costco. And many will make that choice, but not most.
You know, society has always managed to enforce the social order without the need for government — to decide together what is acceptable and what crosses boundaries. For at least tens of thousands of years as pre-chieftain egalitarian communities, and ever since. Culture exists as a concept, people can develop a privacy-conscious culture and in some regions of the world, it exists more than in others. Government as a concept is more recent. Big micromanaging government, even more recent.
You just need to not be lazy and do the work, not expect that someone else will come and solve all the problems for you. Of course, people have become quite complacent these days. They don't set boundaries if it's more convenient for them in the moment. But culture is more effective than government in dictating what is right and wrong, except for autocracies. Some have been very effective in imposing a social order. But I don't think we need to go there. People can self-manage. The question if whether people want to self-manage or if they prefer the consequences of not doing so.
For example, the culture of data privacy exists in some European countries more than in the US. Laws like GDPR are a result of this culture, they are not dictatorial imperatives going against what people want and practice in their lives.
The people usually set the norms. The law only enshrines them.
Yes, I agree with naturally arising collective action through culture. I argue that this may be all we need and we can do just fine without government intervention. I don’t think government intervention can be as robust as cultural norms, anyways. Tech companies constantly find ways to dance around laws. They can’t dance around their primary source of income choosing not to be exploited.
And this doesn’t have to be all-or-nothing. As more people will value privacy, a culture will develop that will reduce exploitative business practices like surveillance capitalism. If fewer people will value privacy, a culture will develop that will enable their exploitation. It’s gradients.