I don't think any such regulation can have teeth or actually protect anyone. The mechanism by which data is abused is a moving target that will shift with any regulation you throw at it. It will go to black markets, be reshaped through loopholes, or done in plausibly deniable ways by entities that can bog any legal challenge down in technicalities indefinitely, while still probably making more doing it than they'll be fined for, and every loophole will require new regulation to close it. The only way to regulate data collection with teeth is to make the collection itself illegal, and actually enforce those laws