Explicitly outlawing the practice is good, but since they've already been participating in the violation of our rights and knowingly profiting from it there should be consequences.

I'd be perfectly fine with going after companies that sell data to the government, but I don't think it would be fair to go after companies who were forced to hand data over unwillingly, even if they didn't inform the public it was going on out of fear of reproductions.