Opt-out is really to blame here. Almost everything is opt-out in the US. Go look at how the EU handles data/privacy sensitive stuff: most of the time, it's opt-in.