You don't have to work this out from first principles, the EU have already done this in the form of GDPR. Building a database mapping people's location and selling it to third parties without their consent would be squarely illegal under GDPR, and result in massive fines given the entire business model is a breach rather than this being an oversight.
Yeah, honestly, GDPR isn't perfect legislation, but it's pretty close. You could just copy-and-paste GDPR into the US and, with actual enforcement behind it, most of the egregious violations would be fixed pretty quickly.
