The Do Not Call Registry obviously isn't 100% effective, but one possible regulatory move would be to create a similar service for email and phone numbers used

The Do Not Call Registry obviously isn't 100% effective, but one possible regulatory move would be to create a similar service for email and phone numbers used in marketing lists, such that possessing a list with the PII of a person who had opted out would subject you to monetary penalties. Then make it incumbent on the company to prove that the person affirmatively consented to sharing their PII. An attempt at such a concept appears to exist as implemented by a non-governmental group here [1], although that group is voluntary rather than compulsary, and probably doesn't have anything to do with the shadier data brokers. [1] https://dmachoice.thedma.org/ https://dmachoice.thedma.org/