The practical enforcement of these legal rules will be complicated, I can't deny that. However, if we define the right to privacy with the right level of generality and importance, we will never again be in the situation you've described a few minutes ago. At this time, a company can say that its contract informed the user that it would use their private information for certain reasons, that the user consented, and that it is behaving correctly and complying with the law.
If we had a rights-based law where consent was an important mechanism but not the ultimate purpose, and if a company's monitoring, as consensual as it may be, led to the monitoring of an individual's activities, the regulatory body would have the power to intervene because despite the consent, the substance of the right to privacy would not have been respected.