In the US, you are free to collect any data you can observe (assuming you don't interfere with others' rights). You are also free to trade what you collect with others.
On what basis could someone bring a class-action lawsuit about sales of data that was lawfully collected by a third-party?
You mean breach of contract which could be a tort, but not a "crime". Unless a given state has local laws which have provisions against that... Where advertisers would also fall under... Unless they lobbied for a provision exempting them... To make FB et al viable as an advertising platform.
Social networks are double edged swords by their nature.
On what basis could someone bring a class-action lawsuit about sales of data that was lawfully collected by a third-party?