Are you confusing the spirit of the law with the letter of the law? Or do you really think that banks aren't selling your transaction data?

http://www.cardlytics.com/technology/

Despite the "firewall" between the bank and the marketers, information is being sold - it just requires an extra step on the part of the marketers (leaving the banks legally in the clear).