The obvious, ethical, default setting should affirm that our private information belongs to us and nobody else -- not to Google, not to Facebook. We should call for laws that require them to change their terms of service so users have the option of giving or denying permission to them on holding personal data in storage.
Then again… Google and Facebook aren't public institutions. You don't actually have to use them; there are alternatives. Visiting somebody's website is sort of like visiting their house or place of business—yes, you have certain rights, but those rights simply don't extend to preventing others from putting up a security camera on their own property!
But there's a larger issue here. The Internet, as it turns out, is not a private place in the slightest. It should not be treated as such.