IMHO, the scandal here is not that the data was sold or bought. That's bad, but that was going to happen
as soon as it had been collected.
So the collection is the real scandal here, and it's a harder problem to solve too, because the responsibility is distributed on thousands of people and companies, and because to some degree the users are actually complicit (through wilful ignorance, or through knowingly accepting it for whatever reasons).
The good news is there would be technical fixes for this problem. "Simply" don't use any of the currently infringing apps. Which -- yes -- means fundamentally changing the way we build, distribute, and fund mobile and web apps. It's not easy in practice, but the technical aspect of it is not complicated.
It's gonna be harder to avoid carriers from triangulating a coarse location, but that's an "easy" think to regulate since there are not so many of them. Again, "easy" in big quotes, because of course politically that's gonna be difficult. The regulators want this information to be collected.