To make any real progress in advancing data privacy this year, we have to start doing something about Google and Facebook. Not doing so would be like trying to lose weight without changing your diet. Simply ineffective.

The impact these two companies have on our privacy cannot be understated. You may know that hidden trackers lurk on most websites you visit, soaking up your personal information.

What you may not realize, though, is 76 percent of websites now contain hidden Google trackers, and 24 percent have hidden Facebook trackers, according to the Princeton Web Transparency & Accountability Project. The next highest is Twitter with 12 percent. It is likely that Google or Facebook are watching you on many sites you visit, in addition to tracking you when using their products.

As a result, these two companies have amassed huge data profiles on each person, which can include your interests, purchases, search, browsing and location history, and much more. They then make your sensitive data profile available for invasive targeted advertising that can follow you around the Internet.

This advertising system is designed to enable hyper-targeting, which has many unintended consequences, such as the ability for bad actors to use the system to influence the most susceptible or to exclude groups in a way that facilitates discrimination.

Because of their entrenched positions in a wide array of Internet services, each collecting personal information that together combine into these massive digital profiles, Google and Facebook can offer hyper-targeting much better than the competition.

As a result, they now make up 63 percent of all digital advertising, and accounted for 74 percent of this market’s growth in 2017, according to eMarketer. Together they form a tight digital advertising duopoly, showing no signs of abating.

Google and Facebook also use your data as input for increasingly sophisticated AI algorithms that put you in a filter bubble – an alternate digital universe that controls what you see in their products, based on what their algorithms think you are most likely to click on.

These echo chambers distort people’s reality, creating a myriad of unintended consequences such as increasing societal polarization. On their unending march to profit from more and more personal information, Google and Facebook have shown little regard for all the negative consequences of their runaway algorithms.

So how do we move forward from here?

Don’t be fooled by claims of self-regulation, as any useful long-term reforms of Google and Facebook’s data privacy practices fundamentally oppose their core business models: hyper-targeted advertising based on more and more intrusive personal surveillance. Change must come from the outside.

Unfortunately, we’ve seen relatively little from Washington. Congress and federal agencies need to take a fresh look at what can be done to curb these data monopolies. They first need to demand more algorithmic and privacy policy transparency, so people can truly understand the extent of how their personal information is being collected, processed, and used by these companies. Only then can informed consent be possible.

They also need to legislate that people own their own data, enabling real opt-outs. Finally, they need to restrict how data can be combined including being more aggressive at blocking acquisitions that further consolidate data power, which will pave the way for more competition in digital advertising.

Until we see such meaningful changes, consumers should vote with their feet. DuckDuckGo found that about a quarter of American adults are already taking significant actions to take back their privacy. Helping in this effort are seamless browser add-ons that will block Google and Facebook’s hidden trackers across the Internet, as well as more private alternatives to their core services. I can say from my own experience, you can indeed live Google and Facebook free.

If we do nothing about Google and Facebook, we will get more of the same: more hyper-targeting, more algorithmic bias, less competition, and the further erosion of collateral industries, like media. Enough is enough.

The complete loss of personal privacy in the Internet age is not inevitable. Through thoughtful regulation and increased consumer choice, we can choose a brighter path. I hope to look back at 2018 as a turning point in data privacy, where we awoke to the unacceptable implications of two companies controlling so much of our digital future.

Commentary by Gabriel Weinberg, CEO and founder of DuckDuckGo, which makes online privacy tools, including an alternative search engine to Google. Follow him on Twitter @yegg .

For more insight from CNBC contributors, follow @CNBCopinion on Twitter.