I think companies will always feel they can and should sell customer information to advertisers.
Rather than prohibiting that, maybe we should weaponize it?
Say, pass a law that the person whose information is being sold is entitled to 50% of the revenue from that sale. That any customer can audit those sales to determine if they received the money, with stiff fines for not paying - even if the amount is trivial.
So it's *legal*, but companies have to set up an entire infrastructure to do it.