I disagree, this seems to require users to read and understand the EULA, navigate all the settings (and again each time they change) and have a high degree of i

I disagree, this seems to require users to read and understand the EULA, navigate all the settings (and again each time they change) and have a high degree of information op-sec for the things that aren't mentioned in the EULA or settings (such as 1 pixel tracker images on third party websites). This would have to be done for each and every service you come into contact with. People may not be able to opt out of these services. Many people will buy phones and devices and, when they receive them, discover that the Facebook app and similar apps are pre-installed and cannot be removed. Additionally, here in the UK many schools use Facebook to communicate important information to parents. Even without semi-official requirements, the effect of so many people and organisations running social interactions through Facebook means that people have little choice but to join themselves. I think we need both legal requirements and social standards about how these things are handled to make things like Facebook safe by default, not safe if you and the people you know put effort and expertise into controlling your exposure. PS. I haven't downvoted your comments, I don't know why one of them looks to have been downvoted.