Make it about morals if you like. However the reality is the data would have been gathered some other way. Harvested from AR see the product in your room, and navigation aides probably.
There is a bigger reality about data that I think every needs to come to terms with and integrate into the decision making at levels. That is
1) Any data aggregated and stored absolutely will be used for activities that fall outside the original purported intents for gathering the data, be that entirely innocently, because the stated intents were bold face lies from the beginning and every shade of grey in between.
2) The fact of running a connected anything more or less necessitates gathering of data. If its on the internet a lot of the activity are in someones logs somewhere at some layer of infrastructure for reason operational, legal, development, accounting, etc - no promises of 'we don't log' blah blah will really hold up. Again even honest well meaning operators might not really know what their PaaS provider really stores about that 'api gateway' and that might silently change for day to day too.
3) Anonymization of data is usually a joke. If you really obliterated enough identifiers on records to anonymize information it would no longer have any analytical value. "We anonymize our data, means we stripped off the names, addresses, and tax-ids also we pinky swear we won't try to join the dataset with any others that are likely to one again uniquely tie a set of records to definite individual we might even ask the people we sell the data to nice to not do that as well'
4) The value of the promise in three is worth about as much as the bytes it took to describe it. If the data is in any way interesting or valuable it will be sold, and the entities that 'own' copies will be sold, any restrictions on title to that data and even its providence will be lost, perhaps even intentionally using the transactions to launder it so that isnt subject to whatever privacy policy terms some idealist might have snuck in when the business was start up. If it is anything actually juicy nobody will be able to identify what party even has liability or get any court to agree to it, if it is data like name, age, and ssn everyone in the world already knows anyway maybe some class action against an Meta or and Alphabet might succeed so the prosecutors office can look like they helped with something everyone will get a check for $10 and 6moths of credit monitoring, the company will consider it a cost of business.
- The only real solution here is for the public to continue to reject things like flock cameras, and consumers to stand up and demand devices that work offline and without creating some kind of 'account' - fat chance either really happens.