> How can such data be sold without the consent of all involved parties?

In the US, whoever owns the computer owns the data on it. Courts have routinely ruled that you have no say in what other people collect about you. The goal of bankruptcy courts is to minimize the losses of the creditors. And bankruptcy courts routinely rewrite contracts except where statute prevents it (like mortgages).

In the EU, you own the data about yourself. A lot of people utterly hate GDPR, but that's reason that you own the data about yourself.