Data brokers are absolutely, 100%, verifiably selling data collected by large american tech companies and selling them to foreign actors. See: Emerdata for one example. Yeah, the FTC makes attempts to take on these companies, but only if they find out about their activities, and even then, only years after the fact.