The law that was passed just requires the NHTSA to create requirements. The law itself does not mandate that auto manufacturers do anything relating to this (it might have other items for them but I didn't read the full bill). The NHTSA says that the technology that they are looking at is just not ready/accurate enough to be enforced.

100% auto manufacturers are selling that data. As you said there is no law stopping them. We should fight for data privacy rights across the country. But that is not really what this article is talking about. They are talking about government surveillance which we should also fight against. But I doubt that auto manufacturers are just going to put a government backdoor in just because.