Sure - some kind of trusted execution environment (which I would argue we don't understand well yet) would be an ideal solution. But... a trusted execution env

Sure - some kind of trusted execution environment (which I would argue we don't understand well yet) would be an ideal solution. But... a trusted execution environment would be no use if it wasn't mandated, so it is secondary to having rights enshrined in law. And yes, there is a trust problem. But I think it would be very difficult to operate a massive data collection empire on the scale of Google or Facebook without at least one whistleblower exposing it.