I guess the question is whether selling targeted ads counts as selling personal information under this law. My impression is that it doesn't, which makes me wonder what the author was thinking. In fact, this will be worst for the smaller companies that don't harvest, target and serve all in-house, while the behemoths will be untouched.