Apologies for the late response. I wrote "explicitly". What I mean by that is that privacy laws already very likely make it illegal, but those laws don't mention "new" technology, so it's kind of open to interpretation until it's tested in court.

Politicians looking to score will often introduce new laws that explicitly make certain practices illegal instead of waiting for jurisprudence.

In this particular case: if you were to register people's visits to a wide range of locations IRL and sell that information, that would be a clear violation of privacy in many countries. It doesn't take a brilliant lawyer to argue that principle also applies online.