We need legal action on this. Reselling data needs explicit user permission with the user being able to decline. This would be very burdensome but it seems to be the only way.