But even under a civil-court "preponderance of evidence" standard, wouldn't you have to prove some material harm to be eligible for damages (not just the potential of the data perhaps maybe being misused possibly)?
Second the problem statement I made above itself shows harm.
The fact that consumers have to worry about who got their private information, what was done with it, what harms happened that they aren't aware of, such as not getting a job, housing discrimination, loan discrimination, etc. is itself a harm.
That these things happen, in general, is eminently provable and that fact causes worry, anxiety, and changes in behavior which is itself a harm.
There might be some precedent in the space (cigarette ad campaigns were severely curtailed during the "Big Tobacco" crackdown in the US), but ads in general? Good luck.
So, some users had their browsing habits illegally harvested, stored, analyzed, and sold to an unknown number of parties for an unknown number of purposes, many of them adverserial in nature to the well-being of the individual. So what?