And it’s explicitly opt-in, not opt-out.

And with a required minimum percentage of those data sales going to the individual.

Yeah this is just whack-a-mole.

Multibillion dollar business idea: shitload of shell companies that keep your data constantly in circulation, undeletable. Subscription service that just re-sends your data to companies after deletion.

passing a law that makes it illegal to sell any of someone’s data

A nice thought, but how to enforce this law? How to prove they gave or sold data? It's easy for them to hide/delete records of data transferred.