I can't wrap my head around it. Selling location data is so obvious violation of privacy (don't even start with that "anonymized" BS), that selling and also buying it should just be a federal offence right off the bat.
That's because, the general availability of such data is of benefit to the government. Who needs the permission of the courts when the data is legally available "on the streets."
Laws are old. Wiretapping is a crime. Harvesting web browsing history is not. US Mail is legally protected. Email is not. Until a law is passed data brokers will ply their trade. Even after they will work right up to the legal limit.
That's part of the problem. Judges interpret these Constitutional rights narrowly. There's no fundamental right to privacy, just criminal procedure rights. The US Constitution applies to the government not companies.
Searching US Mail? Need a warrant. Searching emails? Third party doctrine means it's A-OK as long as the emails are older than 180 days. Banning a book is not okay but seizing a domain is fine. Searching your briefcase requires a warrant but searching your Dropbox.com does not. It's like our rights end at the intersection between the real world and the Internet. I predict a huge scandal has to happen before privacy laws explicitly include digital personal info. Even the Snowden leak only lead to a law protecting phone call logs but not Internet footprints.