Now you are arguing separate issues. There are three concerns here: data collection, data brokering, and data security. Your complaint is about the latter two

Now you are arguing separate issues. There are three concerns here: data collection, data brokering, and data security. Your complaint is about the latter two. Addressing the data collection would certainly address the other two, but if those are the concerns why shouldn't we make laws focusing on them rather than the collection?