It being for sale means anyone can be doing it which might be a framing that would be more alarming to the law-and-order types.
But really you need a two prong solution:
1) restrict this from being collected and compiled in the first place, eliminate the ability to default to this tracking unless someone opts out
2) restrict the government's ability to use or acquire through non-market-based means. The claim here is that there's already restrictions on this vs directly surveiling, but I haven't seen directly which specific restrictions those are for buying off-the-shelf info and the article doesn't specify.
There are very really no companies that I trust to keep my data safe for 10, 20, 50 years. Leadership changes, ownership changes, etc. We have to cut it off at the source.
At the same time: I sympathize with LE and intelligence service operators that have their heart in the right place and that would just like to be able to do their jobs in a hostile and hard to navigate digital environment. Tech moves so much faster than they can keep up with.
Having data on everyone and then only using it against people they want to use it against is exactly what the Stasi did. Obviously this is their dream come true --just a little to late for them.
U.S. v. Miller [1], which established the third-party doctrine, turned on whether "the business records of the banks" to which the defendant could "assert neither ownership nor possession" could be accessed by subpoena versus court-authorized warrant. (The context turns on bank records. Smith v. Maryland [2] expands it to "phone numbers [conveyed] to the telephone company.")
This seems trivially fixable with legislation. Requests made by the government to third parties in respect of specific persons' non-public (even if not strictly confidential) records require court approval or the first party's consent. Also, easier than trying to expand he definition of "houses, papers, and effects" [3] to cover our data in various clouds: defining, in statute, that there is a legitimate and reasonable expectation of privacy in the phone numbers one dials to speak to or message with another person or persons, e-mails one sends to a small group of people, handles one provides a messaging service marketed as encrypted, and articles (e.g. documents, photos and work products) uploaded to a third party's server for personal use.
[1] https://tile.loc.gov/storage-services/service/ll/usrep/usrep...
[2] https://tile.loc.gov/storage-services/service/ll/usrep/usrep...
[3] https://constitution.congress.gov/constitution/amendment-4/