It’s the same thing for medical data. Hospitals can’t sell your medical data in the US but if you google stuff or engage with media that tells you have a medical condition… that’s fine. So much so that they will sell data that includes who is pregnant or has diabetes and such.