Yes, that is what many people thought because people assume that a state with a reasonable commitment to individual liberty would have safeguards in place to force merchants to not spy on them.

The fault is not with the idea of expecting that you own the data that you made and the equipment that you purchased. The fault here is the regulatory structure that makes you by default not the owner of your data or your things.