The potential for abuse of personal private data like location, movement profile, corelation with other movement profiles, etc, is so ginormous it blows my mind it's legal to keep the data for years, let alone to sell it to private companies.

If that is true then that means there is no data privacy protection in the US?