Maybe they should have GDPR-like fines (I am not saying that GDPR it self is good!): "In some cases, violators of the GDPR may be fined up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater."
AT&T's revenue is 170.756 billion so the fine would be up to 6830 million dollars, or almost 7 billion dollars.
Maybe this kind of threat would stop them from selling this private data.