It’s not about profiting, it’s about handing over data to a third party without explicit consent. And yes, I am aware that’s how the credit companies like Equifax exist, they should not.

I see, so the problem is that the data sharing is opt-out instead of opt-in? This seems reasonable, although I'd be concerned about a law where J. Random Codemonkey puts up a free game on his website and gets prosecuted for selling the analytics data.

What does analytics data have to do with it? It is neither personal nor sensitive if it is a game. Why are you trying to compare this with a social media site that can sell your sexual orientation and all your friends location to anyone. The uses are not just limited to manipulating the masses, it could also be used by kriminals or foreign governments who are looking for weaknesses among public officials (for example through their families). Analytics from a game (or any small app) cannot tell you these things on a useful scale and granularity.

That depends on the game and how the site is implemented. It could very well collect or infer that data.