That actually reinforces my point: there is no affirmative right to privacy, only reactive liability structures. If someone hacks Safeway, they’re prosecuted not because you have a constitutional or general right to privacy, but because they violated a criminal statute (e.g. the Computer Fraud and Abuse Act). That's not a privacy right -- it's a prohibition on unauthorized access.

As for Safeway selling your data: you're admitting that it's on the individual to opt out, negotiate, or avoid the transaction which just highlights the absence of a rights-based framework. The burden is entirely on the consumer to protect themselves, and companies can exploit that asymmetry unless narrowly constrained by statute (and even then, often with exceptions and opt-outs).

What you're describing isn't a right to privacy -- it's a lack of one, mitigated only by scattered laws and personal vigilance. That is precisely the problem.