Seems to me like it would be better to require an opt in from the person having their data harvested so that bad actors could more easily be punished by the market, and to incentivize passing value from the data collection to the person on whom it is being collected.