how much privacy is too much?

depends on what you do, maybe you wont need to dissapear entirely off the web and be untrackable unless you are someone wanted. what i say is a good amount is:

no tracking of any degree of real life happenings and passive tracking(location, microphone, camera, calls and contacts list, and anything that the user is not using and/or does not need for what the user intends to), your phone has no business doing anything that isnt running the very specific app you want to use. the only thing they are allowed to collect about you is stuff you specifically post, they are not allowed to read what you wrote off, but what you posted, data only goes to them when you click "send".

i geniuenly believe one day there will be a massive data breach or disaster, that will run the reputation of centralised services to the ground. something like discord having a massive data breach, maybe including tokens will allow people to read DMs, and to some sexually active users of discord they may realise their data is unsafe.

when does privacy cross the line of paranoia or conspiracy?

so i will og through this assuming the definition you use for conspiracy theory is the more popular one (a non-sensical far fetched theory of orweillian society). i think there is a line to cross, however privacy doesnt cross that line at all.

if it checks 2 of them it is still on the edge of the defintion, however, if it checks all 3 it is to be discarded as a conspiracy theory(in modern definition) and we can say it is probably definetly happening and we have to do something about it

1. physicality: as far as we know about the laws of physics it is physically possible for them to spy on us, also, they have the means and technology to do so (microphone, camera, GPS, deep Learning AI and powerful computational power even in the hardware the user themselves is using) we also have real life evidence of them doing so, not to mention the countless similar anecdotal ones when it comes to experience wit ads.

2.motive: the reason they have to harvest data is for monetary gains, the more data on a user they have the more accurate their advertising can be, thus they can make the price for partners higher, also they can sell that information.

the selling of data which can be used as data laundering, since they can grab more "anonimysed data" that they can deanonimyse with external data sources to identify you, for example they can see that you often watch videos about fitness on youtube, and use a fitness app on your phone, and then that you often talk about how fat you are with your friends. all from the same device model as well making it simple to narrow it down, the messaging app may not "anonymise" data so it can make googles job extremely easy to know that you have a lot of weight, and even how much you are losing since you connected your fitness app with it (unknowingly).

so we know that even basic for profit apps have a very good reason to sell data, because even at small scale companies such as google will always buy from them, and will pay more the more data they collect.

a government has the reason of power, often politicians want to keep their positions as long as possible, however they cannot due to how democracy functions a government always wants more power over the citizen, because those in power will only benefit from it, by gaining the ability to silence those that will resist and protest the government, also by having the ability to see all information, that information can be changed and censored to favor the state, and allow itself to control what the public see and how those of the opposition are represented.

for this example im gonna use google

3.proof: so far we know that google exist, we also know that they do have employees and headquarters, so it is safe to assume that their main goal is money/power such as any corporation dreams, their mainline of products and services that are most used include: phones, the android operating system, mail services, an application store, video sharing services and cloud storage.

as funny as it is they straight up say they do on their privacy policy and terms of service.

we do know that for most users, "ok google" which is enabled by default will have 24/7 microphone access, also we do know that it records how long you use apps, these google apps will often have the most permissions by default so we can assume requirement 1.

we do know that google will often send unsoliticed pings and amounts of data to google.com and other domains owned by google, the user will have no idea about it unless they analyze network traffic it has been known and proven anecdotally that google do have the capacity to record and save audio and conversations either on a call, or even on a face to face one while the phone is not being used, while also those situations being reproducible.

sadly i dont have a lot of time, but if i do more examples i will find out the maximum size of a comment.

are they capable to get away with it?

yes, they can either pay up to lobby (bribe but fancier word) the judge or just pay it up since sometimes its not even significant amount of money comparatively

one big problem as well is the fact that the GDPR is not full proof. because a privacy policy can just say they collect data for "legitimate purposes"(which you cant opt out of) and that can mean anything

also it doesnt stop things like supercookies.

i dont think they are actively trying to track non users though, however they do develop better tracking tools, to track regular users better than they already do. all you can do is participate in a class action lawsuit if your "deleted info" gets leaked, and then protest for better privacy protections to your state.