Certainly everything is legal, when the user sign the terms and conditions is accepting them. So the user is also responsible, but not the main one.
Although the problem of data and privacy is global, each person has a different approach, I know people who are aware of this news and they don't care what this companies are doing with their information because it's what they have to "sacrifice" to be connected with other people on Instagram or Facebook.
I think the important thing is to offer different alternatives for users according to how they want their information be handled. The problem is that if you leave the mainstream social networks you practically remain isolated from the rest of the people, there should be a massive migration.
A few days ago I saw this thread and I was shocked, they have too much information about us. Take a look
https://twitter.com/iamdylancurran/status/977559925680467968
thanks for adding to this topic @alejandromata. Google hein... Agreed, it is all about alternatives.
If someone understands and accepts the terms and conditions, there is no issue. In certain parts of the world, where Facebook/Google might be the only way to keep in touch with people, users will have a behavior that is different from users in Europe or US.