I think something that's missing here is a discussion of technological solutions to the privacy problem, and ways of incentivizing companies to look for and use them. I work at a place that has developed a privacy-first way for companies to collaborate against fighting fraud without sharing sensitive user info (something which is done routinely under current norms). There must be equivalent developments going on in other fields as well. If there aren't yet in particularly challenging fields (adtech comes to mind as being especially challenging) perhaps funding could be provided to teams with a plan to tackle the issue. Tech is often seen as the problem here, but it doesn't have to be.
I'm reminded of similar discussions that took place back in the late '80s and early '90s -- and the development of PGP that followed it, and the many ways encryption became standard in our daily internet usage. Legislation isn't the only way to approach this problem; if it's going to be part of a governmental effort (all the more so if it's federal) then it seems that part of that effort should include encouraging robust technological solutions to give us all the convenience we love without the data sharing that makes us uncomfortable. Chances are, this doesn't have to be binary.
I do applaud Mr. Yang's decision to make this issue part of the debate, but there's a risk that adding it to election campaign issues will make things seem more black and white than they need to be, which might impact the kinds of solutions people are willing to consider. Which would be unfortunate, because a lot of what's needed to find new technological solutions for problems is the impetus to search for them in the first place.