The main problem is that people expect they have a certain level of privacy protection and shielding of their private data when in reality they don't.
Any respectable business would realise this and indeed protect the private data of their users, Google and Facebook (among others) however deliberately don't, as they're in the business of monetising that data and thus want to collect as much of it as possible.
They can get away with it because they're US based companies, a country where the law regarding privacy and related issues is extremely lax.
European users especially are used to far stricter laws regarding protection of their privacy (as well as consumer protection in general) and act based on the idea that those laws are applied by any company/entity they deal with. Most of them are utterly unaware they live in a bubble of protection situated in a sea of openness where they have no protection whatsoever.