It doesn't matter that the information eventually comes to light, because they're the dominant social media company by that point, buying up their competitors, and it takes a lot more to get rid of them.
There is no way to tell when they sell it but there is a way to tell when they have it to begin with.
If you're using software with public source code that you know is end-to-end encrypting the message to the recipient, you know there is no third party doing nefarious things with the data, because no third party has the data to begin with.
And that's the distinction that matters. Prohibiting a company from selling your data to someone who will do evil things with it is no use if the company itself can still do the exact same evil things with it. Or just get itself hacked like Equifax and reveal all the data to the attacker.
You're assuming that regulatory capture protects privacy better than competition would.
The evidence is to the contrary. Debian and Open Whisper Systems are better at it than AT&T and Comcast.