Would not it be easier to make a law forbidding transferring personal information without a person's consent? Not opt-out, but rather opt-in scheme. Companies like Google just exploit a lack of regulation.