The core issue is transparency. I don't want to see a 'privacy policy', I want to see who a company has sold/given my information to and what limitations that sale has. The concept is simple. If you collect anything about me and allow some other entity access, you tell me about it/make it easy for me to see -and- block. Most of this abuse of personal data would go away if people knew it was going on.
Everything should be opt-in. Burden should be on them, something like, "We want to share your data and if you agree here are the benefits to you."
I'd like auditable data. I should have an easy way to discover everyone with my data (including things like IP logs), see how it's used (at the level of source), and have it destroyed.