Just adding here, what is clear to all of us as Coaster indicated, that aggregate privacy and anonymity are what is really at stake here.

Sure, I’m in public and just walking around. I don’t have a right to privacy in those instants. Some jerk with a camera is within their rights to capture my image.

The other aspect of the laws, though, is that even a few years ago, that image was of an anonymous person. The photographer didn’t know who I was and couldn’t find out without asking me and if a cop wanted that picture they had to request it from the taker. Now, though, that image can be shuffled off to a giant datacenter to be processed and potentially figure out who I am, coordinating the time, place, clothing, activities, nearby people, and myriad other details and the tech companies have no problem handing it over that information without any of the humans ever knowing.

I think the simplest solution is that any LEO querying a company’s data about a private entity should require a warrant or subpoena. Data sharing agreements between companies and governments should be illegal.

The longer solution is that collecting and retaining this information “for business purposes” needs to be more heavily regulated. The current definitions of PII are out of date. PII should include things like location, likeness, mood, etc, and the history of those things. Look at what Walmart and others are doing with dynamic pricing, for example.