I don't think bringing in "bought and paid for" makes sense in the context where we're talking about which policies are even sensible. For example if we do assume that, then this identity verification legislation is exactly what is being bought and paid for, and so there is no reason to examine it.

Pragmatically, what I'm saying could hopefully chip away at the surveillance industry's power without a full-on frontal assault. Maybe forcibly breaking up Faceboot and divesting them of their client software is a bit ambitious, but regulation that forces interoperability of third party clients that represent users' interests would seem to be workable.