They’ll just come up with some aggregated form of the data they claim doesn’t violate the letter of the law, sell that, and be in business for years before anyone finds out let alone tries to enforce the rules and find out of they are violating it.

This would honestly still be a huge improvement imo, as even forcing data brokers to anonymize or aggregate the data, even if it is ultimately not actually providing privacy, is still a recognition of the problem over the current system in most states.