How are fines that are as little as this supposed to deter future companies from sketchy collection practices? One can only assume they made more than $3.7M selling illegally collected data.

There's no incentive for companies to do better and not be shady. It pays to roll the dice and see if you get caught. If you do just say sorry and pay a small fine.