I'd hazard that even with legislation about selling outside the US, a foreign government would still just find a cut-out that looks legit enough and then have them send the data overseas regardless.