I have friends who care about privacy but they need phones that can do Uber and washing machine apps. So I'm the only one i know with a private FOSS phone.

The only time an average person will care about privacy is when it's taken away from them. Generally speaking, people just don't care so don't worry about it too much.

You could start invading their privacy if convincing them with words doesn't work.

Why bother shutting the bathroom door? You're not doing anything wrong.

Post family drama on Facebook, whats the problem with that? Everyone has drama?

Really there is a deeper conversation about power and manipulation through marketing/propaganda. But thats an ever harder topic.

They need to have a reason to care. Are they or people close to them in danger if they don't put effort into increasing their privacy? What steps do they need to take to switch to alternatives, and does what they gain from taking those steps outweigh what they lose? Is your advice oriented around the context of their own lives, or are you telling them to do things because a bunch of people on the internet told you to?

These questions themselves are also very contextual, especially with different political orientations. For instance, if someone distrusts the government, then their definition of "danger" may include the government reading their conversations, which in this case it is a lot easier to convince people to switch to FOSS or more secure platforms like Signal (and I've convinced nearly everyone I know to use it, both conservative and progressive/leftist, because they distrust the government and large tech corporations). Whereas if someone thinks the government is alright, then they won't give a shit. So I'd say that considering and discussing their political beliefs and making sure they align with valid reasons to make changes is an important step before telling them how they should do things.

The thing is, people by and large don't want to be convinced. They want their convenience and ease of use, they don't want to learn a whole new paradigm, least of all one that requires constant vigilance and understanding of the risks. I can't blame them, they have a lot on their mind, and their existing skill set might not be relevant to privacy issues. People in general resist change and effort. I do. You do too.

It's less about you, and more about them. People will only start taking steps when it all clicks for them. What the catalyst will be is impossible to tell, since people are wired differently. All we can do is talk about privacy and advocate for it with people who are willing to have the discussions. Don't expect to go in and change people's minds. It's horribly difficult and you will be disappointed. Instead, think of it as giving people perspectives and starting points for their own journeys. If something happens and they are finally willing to start doing the work, they will at least have some context and words, labels to use. They may even come to you for more. They may not.

the easiest way to get them to care is if someone is actively invading theirs.

are these like RL convos, how do you enter a convo about changing their minds about privacy

I think a lot of people confuse internet security and internet privacy. META, Google, M$, and their ilk are highly concerned that your account is not hacked, but then use/sell every aspect of your personal life for profit.

Now when you say "care about their privacy" do you by any chance mean buy something? I just want to know what you're asking for help with here.

I just compare it to having a stalker. Imagine being in your bedroom and having someone looking at you from outside the window. Now, would you be ok with it if the person was invisible?