I take your point that some level of this power exists, necessarily, within internet-based companies with online users.
But I think there's a big difference between, say, signing up to Grindr where you submit a basic form with limited information (and presumably) can retain some minimal anonymity in how you use the app --- and a system whereby the history of all your actions across your online life (banking, social media, dating apps, etc.) is collectable by a centralised agency.
With laws like GDPR, broad datasets have become a liability for companies like telecoms, banks, etc. They don't want it. Accidentally forming 'rich user profiles' based on non-annoymous data is a legal liability.
This is exactly the incentive structure needed. Rather than have companies with an existential profit motive to build mass surveillance systems.
As far as whether a relational database that takes user data from a form is different to a whole system of streaming live event databases with massive streams of user monitoring across websites --- well, I think it wouldnt be hard to write a law against the latter.
These are political, moral, legal and technical distinctions that can be drawn.
Keeping all of the data under one company umbrella is vulnerable, target for hackers, and easy target for governments.
Your post is not correct.
They do tough. They know where you refueled/charged your car, hotels you've booked. Not only that, but they also know if you donate money to your local mosque/synagogue, spend just a bit too much at a liquor store, etc.
This part of your post is also not correct. What company knows everything about you? There's insurance companies, credit card companies, social media companies... they all have a substantial amount of info about you but they don't all collude to aggregate it.
No regulator will find any proof of anything though, as regular employees will not have access to such crucial data. Regulators will also can be fooled by the maze of interfaces and servers.
There is also incentive for governments to "not see" any wrongdoings of the companies, if they profit from surveillance system.
Ad business is like Palantir in lord of the rings. You do know know who is watching on the other side.
All you have is some "vague" promise from corporations that your data are properly removed.
If however there were strict liabilities for data leaks or privacy breaches, businesses would collect just the bare minimum data and get rid of it as soon as it is not strictly needed.
There are real privacy issues here, but this kind of paranoia distracts us from mitigating the actual threats and has us jumping at shadows.
e.g. what are 3 30 year olds in Toronto talking about this saturday? likely the drake concert, winter tires and xmas related things..