>> How about no free stuff on the web? Charge for services and make it illegal to sell private information without the subject’s consent and remuneration.

> Making it illegal won't solve much. E.g. FB doesn't sell private information, they sell the ability to target demographics.

You just need to appropriately specify what's being made illegal. You're right that FB could weasel out of a law that outlawed selling private information. They couldn't weasel out of a law that outlawed monetizing personal data without user consent.

The way to criminalize it properly is to create a presumption of criminal activity when an advertiser benefits from ad targeting. Literally anything more than the advertiser choosing what sites to appear on should be made criminal. No other criteria allowed.