That's not quite accurate. The law allows you to legitimately ask for permission to share the data for advertising purposes, but you have to be transparent with the details, and the advertiser has to have the same safeguards on the data as your company (they aren't allowed to re-sell it without the original company's knowledge, for example).