It being for sale means anyone can be doing it which might be a framing that would be more alarming to the law-and-order types.
But really you need a two prong solution:
1) restrict this from being collected and compiled in the first place, eliminate the ability to default to this tracking unless someone opts out
2) restrict the government's ability to use or acquire through non-market-based means. The claim here is that there's already restrictions on this vs directly surveiling, but I haven't seen directly which specific restrictions those are for buying off-the-shelf info and the article doesn't specify.
There are very really no companies that I trust to keep my data safe for 10, 20, 50 years. Leadership changes, ownership changes, etc. We have to cut it off at the source.
The first is the automatic civil penalty for copying copyrighted music recordings. If you're caught and proven liable, the dollar amount of damages don't need to be debated -- they're pre-determined.
The second is the concept that mere possession of certain kinds of information (unspeakable pornography) is a criminal offense.
I think some combinations of these concepts could create a bounty system for victims to collect on the abuse of their personal information: 1) Improper possession is inherently illegal. 2) Offer for sale or transfer of the information carries an automatic civil penalty.