You don't have to work this out from first principles, the EU have already done this in the form of GDPR. Building a database mapping people's location and selling it to third parties without their consent would be squarely illegal under GDPR, and result in massive fines given the entire business model is a breach rather than this being an oversight.