Neither private companies nor the government should be collecting data from/about citizens without probable cause and due process.

That could all be codified into the regulations that classify internet as a public infrastructure service.