Organizations the size of governments should have the checks and balances of governments.
Operating a successful business or media agency in the 21st century is essentially having a lot of data about a lot of people all in one place. Current businesses are incentivised to collect data at virtually infinite scale.
All cloud companies are so large that they are able to leverage data with similar efficacy as surveillance agencies. These businesses typically have a diverse portfolio of cloud, media, and retail services, and they use the information they have to steer the sentiment of their customers, predict and influence market trends, and subsidize retail and distribution in a way that makes small business completely non-competitive. Sounds a lot like a government, doesn't it? Where are the checks and balances?
The sheriff doesn't stroll into your saloon to investigate a suspicious character; the saloon instead collects as much information as possible about everyone who walks in, and a looking glass is exposed to intelligence agencies with all data across all citizens. The real, live human investigating you does not have to feel the true invasiveness of surveillance; the act of invading someone's privacy is made completely opaque and automatic as a side-effect of doing business.
The argument provided by the NSA is that "if it's happening to everyone, it's happening to no one". This does not correctly address the problem. The incentives structure is not set up for the businesses to be reputable on their own. Businesses are too big to have ethical opinions; the only thing that moves the needle is the bottom line, despite multi-national corporations having more power than the UN. Organizations the size of governments should have the checks and balances of governments.
The most ethical thing businesses can do is be responsible for any data that comes in, as well as the material impact of leveraging that information. Google/Alexa/Siri have obvious permissions models; “I am speaking to a genie in a bottle and it can hear me”. Even social networks sort of do (to the strong exclusion of tracking cookies). When there is a clear transaction of "my data is being consumed by this service", you have correctly obtained consent from the customer, but the customer can't possibly connect the dots for how that information is being used.
The thing which saves, in any case is freedom. This is the singular faith of freedom and liberty. The Christian faith, as with all faiths, means putting your own eyes back in.