It's not even just data stored on US servers. According to the CLOUD Act, any data stored by a US company, regardless of location, can be demanded by any authority in the US. No sovereign nation should use US companies for data storage or processing. Period. The attempts to shift to open source or non-US services are inevitably hobbled by US companies lobbying (read: bribing) politicians.
European countries aren’t known for strong privacy against the state. There are exceptions, but the EU’s “privacy rights” are almost exclusively against corporations. American privacy, by contrast, is almost exclusively focused on state surveillance. There are holes, the biggest being that foreigners on foreign soil have no privacy rights. Nor do the dead. But I’m not impressed with the “rights” Europeans have agains…
The key thing is that companies like Google and Meta run giant ad networks, there's many thousands of companies buying ads then collecting data in their own systems and reselling it.
The privacy issues of data retention on Google/Meta/etc social and SaaS platforms is something to care about but it is only a small piece of the puzzle of data privacy.
Ads will remain a major business for the foreseeable future as nobody is going to pay $5/m to use Instagram with no data collection.