Only regulation can fix this, because for the company it's nothing but upside. They can double-dip by selling data, gather data on their users, etc. There is no downside. There are nowhere near enough knowledgeable people who will balk at this stuff, and even if there are it won't matter if/when everyone does it.

All economic incentives encourage maximum invasion of user privacy. That's almost universally true in my experience.