> We have all sorts of ad tech collecting huge profiles and yet where is the demonstrated harm?

It's simply down to lack of consent, other tech companies will do the same, after you agree to intentionally over complicated TOS'. And there are examples of collected analytical data being used for nefarious purposes, namely Cambridge Analytica comes to mind. This was collected without consent. Being manipulated and in cases outright lied to into something is being an injured party.

It is an unpopular opinion, but its because it should be. If verizon have a data breach and all that collected information about you is used without anyone even knowing. These things happen, correlating your banking information for example with your personal information happens all the time. A goldmine for social engineering.

> A goldmine for social engineering.

Okay, I mean some medical studies collect data on millions of people, and those datasets too have the potential that, due to security arcana, can be data breached. Does that mean I should be able to sue all medical studies for collecting data on that potential? Of course I support some kind of penalties for data breaches, but you see that it something entirely different from, "data collection itself causes harm." You just can't show that...