Yes, they are, but I think your real point is that:
> I would only be ok with item 2
Yep, this is what it all comes down to. But it seems like everyone else is arguing without even knowing that the scope of this is. It's of course your right to your own opinion about if these business purposes are acceptable. I was even aware that training LLMs and showing ads are legitimate business purposes. You act like that's a revelation, but it's important to realize that is purely your reaction, not the reaction of the average person. Is the average person okay with their emails being used to train LLMs, or show them ads? I mean, what percentage of the population uses Gmail for mail? I think the question is nicely answered there.
> I can almost guarantee allowing business to collect this data will lead to use that doesn't fall under the legitimate business purposes. Uncollected data can't be mishandled
Sure, but we can't just lock ourselves in iron boxes and survive on privacy alone. People have to engage with the world. Maybe credit card numbers should be 100,000 digits long, so someone can't look over my shoulder and steal mine?