You can definitely outlaw this. Under GDPR it’s much harder to lawfully collect and sell personal data large scale. Not saying it doesnt happen still but it gives you a legal basis to fight against it — noyb.eu / Max Schremscand others do some excellent important work on that front