You can definitely outlaw this.
Under GDPR it’s much harder to lawfully collect and sell personal data large scale.
Not saying it doesnt happen still but it gives you a legal basis to fight against it — noyb.eu / Max Schremscand others do some excellent important work on that front