[pariahHN]

I think that would tie in to the enforceable off chain point - if by law Facebook has to respect the permissions you give them, then yes they may have the ability to sell the data you allowed them to read but if you did not give them permission to sell it, then you would be able to pursue legal action.

Which of course would require proving that they did in fact sell it, but it shouldn't be prohibitively difficult to setup a mechanism for taking a data point and verifying whether or not the seller has been given permission to sell it - could have it so that who has access to a given data point and what their permissions are is part of the public record.