What are some of the primary ways that people's privacy is protected from Big Data?

For example, when you fill in an online form with personal information subscribing to some type of service, what prevents that company from selling that information to data aggregators? Are there enforced laws that prevent such a thing?

I know that a lot of phone applications have to ask permission to use location services (GPS). Is that something they're required to do by law or do they simply do it to avoid bad PR?

Part of my question is trying to gauge how effective internet policies are at actually affecting data collection. Do they work or are they simply wishful thinking guidelines that have little to no bearing on business practices?