For example, the culture of data privacy exists in some European countries more than in the US. Laws like GDPR are a result of this culture, they are not dictatorial imperatives going against what people want and practice in their lives.
The people usually set the norms. The law only enshrines them.
Yes, I agree with naturally arising collective action through culture. I argue that this may be all we need and we can do just fine without government intervention. I don’t think government intervention can be as robust as cultural norms, anyways. Tech companies constantly find ways to dance around laws. They can’t dance around their primary source of income choosing not to be exploited.
And this doesn’t have to be all-or-nothing. As more people will value privacy, a culture will develop that will reduce exploitative business practices like surveillance capitalism. If fewer people will value privacy, a culture will develop that will enable their exploitation. It’s gradients.