What I have noticed from reading comments on the subject of online privacy on HN and for the past 15 years is that many commenters believe that a prerequisite for change is that computer users must care. Not only that but they must also take action.
The commenters are all people who either (a) care for their own online privacy and/or (b) are actively engaged in profitting from others' disregard for online privacy. There is no one commenting who does not care, obviously.
Certainly, if the people who do not care joined the people who do care, and they each took unilaterla action to protect their privacy, and this was actually effective, then that is one possible path to change. Admittedly, it seems rather far-fetched.
Another path to change is regulation.
For example, when I consider the history of telecommunications, I recall federal regulation to protect customer privacy before the internet despite that there were few people actually had reason to care about the issue let alone took action on it. Many of us have living relatives who can recall the "party lines" they once used. Customers accepted the high probability of eavesdropping.
But eventually judicial decisions and later federal legislation in 1968 gave telecom customers certain privacy protections. It did not matter whether all customers cared about privacy or not. Nor did it require all of them to take action.
https://www.newyorker.com/culture/culture-desk/the-bootlegge...
It took forty years to get from Olmstead to Berger. That is longer then the public www has existed.