An interesting tidbit from Mozilla’s latest privacy release (https://www.ghacks.net/2023/11/21/firefox-120-ships-today-with-massive-privacy-improvements/):
The first introduces support for the Global Privacy Control in Settings. The privacy feature informs websites that you visit that you don’t want your data sold or shared. It is legally binding in some states in the United States, including in California and Colorado.
What’s to stop users from utilizing a VPN exit point in California or Colorado to force the binding nature of the request?
Not all, but some will and that’s good enough. Security and privacy is all about layers, not guaranteed solutions.
That said, if you have “business” with a company, they are probably using your registered home address to understand how to deal with your local laws/regulations. e.g. If you’re using a registered google account and don’t have an address in a state that offers protection, its very unlikely they’ll extend any privacy policies to you just because your IP says you’re in California, for example.
OTOH, if you don’t have a registered address/account/profile and your IP is coming out of California, its possible some companies will apply stricter policies based on your preference.
To your original point though, yes, shady companies will continue to behave in unethical ways.