So President Obama is finally ready to do something about the government storage of our phone records, preparing legislation for Congress that would partially change the National Security Agency's bulk collection. Except he's missing something much more important: all of the other, much more revealing data we generate simply by living our daily lives. What about all of the other data that internet companies buy and sell, and that yet more companies create and sell without even telling us – indeed, all of the rest of a data retention program that you and I helped build?

Of course we should be skeptical of the new NSA laws – of government objectives and Congressional fears and loopholes the intelligence community will inevitably bake in. Obama says he needs "to win back the trust ... of ordinary citizens". But we can't even begin to feel reassured about the long-term trajectory of surveillance in America, not when so much of our ordinary communications don't take place on the usual phone-record system at all.

Because of course we store our email in the the cloud. Of course our information is moving to new networks and multiple devices. Of course we willingly log in to Google to make our lives more convenient: faster commutes! Instant weather! And for that convenience, internet companies make vague promises on security but always reserve the right, as Microsoft did so notoriously last week, to snoop when it suits their own interests.

But the future of information hoovering is about much more than "metadata": this is your every move, collected and massaged already by an array of for-profit companies, as well as a new generation of businesses being created to take advantage of the very real benefits – and very frightening downsides – of what's being called the Big Data era. Part of this is the longstanding collection by third parties that exist to know – and sell – everything about us. Companies like Acxiom have way more personal information, and get far less scrutiny, than the online operators, though that ratio is changing as the Googles of the world push for ever-deeper understanding of how we behave and think, how we get to the bus stop and dress for work.

Another part is even more hidden. The police need a warrant to install a GPS tracker in your car, but they can just buy your location from businesses that aim, via license-plate photography, to build a nationwide database of everywhere you've driven. This kind of bulk collection is going to spread, because it can.

The worst part is, you and I have too little control – if any.

As an ever-deeper web of data grows, and as companies collaborate reluctantly or willingly with government agencies – agencies which will hack those companies if it's not satisfied with their cooperation – we are becoming bystanders to the demise of privacy.

Over recent years, a concept called "data retention" – a wonky way of saying "record and store what people do and say" – has popped up in policy arenas, especially in Europe, relating mostly to our online activities. Snoops of all kinds want internet service providers (ISPs) to record and store everything we do as we use the internet. Since the phone carriers are already retaining our data, the logic goes, why shouldn't the online companies do the same? Maybe they already do. Only the ISPs know for sure, and they don't provide much public guidance on what they keep and for how long, even with what internet addresses we visit.

The ISPs have, in addition, made themselves deputies in Hollywood's war on copyright infringement. The year-old "Six Strikes" system of warnings followed by service cutoffs – guilty until proved innocent – relies on storage of such data, although no one seems to know how it's working. And then there's the ugly abuse we've seen from copyright trolls, which relies on data retention, too.

Unless we use services like Tor, which encrypts and hides our activities even from the ISPs, we're giving the new data miners an incredible insight into how we live. Unless we choose not to store our email on other people's servers, they can also probe, deeply. Do we want these companies, which want to extract increasing tolls, to know everything? Except in rare cases where they choose not to have this capability, data retention is part of their very business model. All of this activity makes it increasingly essential for internet users to adopt encryption at every possible level of what they do – to find ways to scramble their data from one end of their communications to the other.

It takes no imagination whatsoever to foresee a time when companies and governments, often working as partners, will record and store everything, indefinitely. We need policies prohibiting such eviscerations of our liberties. But we'll also need, if possible, to scramble the data they keep, so they can't abuse it.

So as Obama grows fierce over phone records, ask yourself: are we talking about the right reforms here? Maybe we're missing the larger point.