So then you agree that a boycott is actually not the "only one way" to react?

Your original comment makes it sound like you think that nothing else is possible, which would exclude things laws around privacy rights or liability for mishandling personal data.