Companies aren’t trying very hard to give you control over your personal data. They may not even be complying with the law.