We say we care about data privacy, but our actions tell a different story. Here’s why