Ghost in the Machine :
I hear you, and as far as I am concerned government sanctioned mass eavesdropping is a major concern. I don't know why governments have become so terrified of their citizens. But it's a separate issue, and I personally can do very little in the face of state paranoia. And please, don't tell me "it's for my security."
What I am concerned about, in this particular instance, are companies like Microsoft that I pay good money to, (you will pay for Win 10 sooner or later) seem to think it's alright to access my PERSONAL private data.
It's NOT OK.
I don't care if they are using it for advertising or relaying it to a state department. If I'm going to pay for a product I EXPECT to have my privacy respected. If Microsoft (or any other business) can't or won't do so, then I will take my business elsewhere.
Violation of privacy has become the new normal for institutions and companies, and I for one, am not happy about that. People have become very blasé about data collection and privacy, but arguably they are at greater risk of identity theft and fraud than at any other time in history.
I'll step off my soap box now, but let me finish by saying this: The right to privacy is supposedly enshrined it law in most civilized parts of the world, and is essential to free and fair democracy. I won't give up the right to privacy without protest.
I would agree that mass eavesdropping BY the government is a concern. The government is not sanctioning the data collection done to us by Amazon, Google, or Microsoft. They're not STOPPING it, but I'm not sure there is legal ground to do so.
If you don't like what Cortana does, DON'T USE IT. Or Google Voice, or Siri.
The argument about privacy has mixed legal standing. It is NOT a right enumerated in the Bill of Rights, for example, and the state need only show probable cause to get a warrant that will, of course, throw 'privacy' out the window. Further, there's a specific exclusion in the Do Not Call law that relates: companies with whom you have already established a commercial relationship can call you. The situation is very similar to Amazon feeding you tailored ads and emails.
Where you stand a much stronger case would be in the selling of information to an outside agency. There is such a thing as an advertising ID that's used for this online. Windows 10 lets you turn this off...so does Chrome. More companies are explicitly stating they won't do this; the information will only be shared in-house, or sometimes with certain key business partners, or of course with law enforcement, if that matters. But there is no *law* that requires them to do this in general. Medically related stuff...yes. That has explicit privacy coverage. I'm sure there are other areas that don't spring to mind offhand. But standard commercial transactions? They're not protected.
As for identity theft: make no mistake, it has existed forever. Impersonation and forgery were the only ways before computers, and those took considerable work, making it impractical to target most people. Do you remember the days when checks took several *days* to clear? When you looked in your mailbox...not your Inbox...for your bills? Last time I wrote a check was to my periodontist...because he offered a 5% discount for paying in full, NOT on plastic (ergo saving him the transaction fee). The bill was *easily* large enough to justify it. Overall, I seriously doubt I write 10 checks a year...bills are done electronically, or with an auto-pay arrangement, and most shopping gets done on plastic.
An *inevitable* consequence of this is increased risk of identity theft. Every site where you pay a bill has a login. And a password. I had about 10 such sites to check every month...phone and internet, wireless, satellite TV, satellite radio, and so on and so on. Password managers weren't all that common...certainly not well publicized...until recently. You might have seen Dashlane's recent ad..."they kept their passwords in with their emails, and someone stole them." That DID happen; malware targeted address books and other such areas. And of course, there were the major data breaches, such as those at Target and Home Depot. The actual *damage* from these probably wasn't terribly high; the credit card companies watch for these things. (I've had this happen. One time, it was some computer gear, ordered off my card, to be sent to Russia. Uhhh...no, it wasn't me. The transaction was blocked, the card shut down, and I had a new card and account number in a day or two. And, no, it probably *wasn't* anything I did...it was just as likely to be information from a vendor I use.)
The vendors have to maintain your card information for at least some time, to properly handle returns if nothing else. Most offer to save card numbers for convenience...but more are NOT saving it by default, or do so on your side with a cookie, to reduce this risk. You can also arrange things with some credit card issuers, to set up single-use card numbers, or single-use validation codes, for a transaction. Fine, steal THIS number.
Identity theft is NOT a problem linked to questionable (and yes, I'll go that far) data collection. The notion of what is, or is not, private is ambiguous. I compare many privacy rights advocates to free-speech advocates...they really don't understand the issues involved, or the limitations.