You called them private companies, and I’m disputing that.
This distinction is important, because the properties that make it non-private (being owned by a public collective) also happen to make people particularly vulnerable to spyware and data collection. That which is owned by a public corporation is owned by its shareholders collectively. Major shareholders can therefor lobby corporations to divulge data that is technically legally theirs. When you consider how many corporations Black Rock and Vanguard are invested in, there isn’t much that you can touch without generating some meta-data level evidence of what you’re doing, where, and when that they won’t have access to.
If things were truly privately controlled, nobody would be able to lobby a bank to divulge information about its clients.