Actually, the regulatory language is easy. "You may not buy or sell user data."
The friction comes from the fact that a large part of our economy is highly dependent on the ability to buy and sell user data.
But as you note.. surveillance economy will not be happy about it and likely fight back.
Amusingly, the people who understand the risks and take precautions are also least likely to put a spotlight on them, which privacy-conscious tend to avoid.
This is only a recent part of the economy that the world would not collapse if we went back to a time of it not being part of the economy. Just because something is does not mean that it should. There are plenty of historical example of where something was that was not right that took time so that eventually what is is now no more.
But I don't believe that the existence of black markets means we shouldn't regulate legal markets. Even if it's true that bad actors would try to find new ways to exploit data as regulations change, this doesn't negate the value of regulation entirely. Lots of industries face similar challenges (e.g. financial regulation, environmental protection) yet still benefit from regulatory frameworks.
Furthermore, the existence of loopholes is an argument for crafting more robust and adaptable regulations, and knowledgeable bodies to govern them--not for abandoning regulation altogether.
I believe the easy workaround is to designate the other party a "data processor" or something of that sort.
"We're not selling data, we merely allow partners to access it to generate reports for us."