[Hokusai]

> about expected value and perceived risk. Overall for most people the equation is always: (probability of data being mishandled) * damage < time and effort required to maintain my privacy.

That is the main reason. To keep privacy is too costly on purpose. In Europe, thanks to the GDPR you can get quite good privacy. But companies give you a 1-click option to be tracked, And then company that build products usually 1-click or 2-click to not be tracked. But ad-based companies will ask you 3,4 or sometimes even dozens of clicks to not be tracked. That extra effort is on purpose and should be regulated. When you get a pop-up "Do you want to be tracked (Yes/no)" most people chooses no.

[Nextgrid]

> companies give you a 1-click option to be tracked, And then company that build products usually 1-click or 2-click to not be tracked. But ad-based companies will ask you 3,4 or sometimes even dozens of clicks to not be tracked

The GDPR explicitly forbids that. If you're going to do that you may as well not ask to begin with because you'll be in breach either way.

The problem is that GDPR enforcement is delegated to incompetent idiots and very little of it is being enforced, so these breaches go unpunished. At this point it raises the question of whether the regulators actually benefit from it not being enforced.