An academic who has done some great work on this is Evgeny Morozov. Highly recommend his books, articles and lectures.
The massive industry that has been built around advertising and personal data trading needs to be regulated.
I specifically want to avoid the Equifax comparison because it looms large in people's minds as an example of an intrusion and forceful removal of data, which is not what occurred with Facebook and Cambridge Analytica. We should have better laws around protecting sensitive data from intruders, too, but they won't be the same laws prohibiting companies from selling data they've collected on us. Conflating these problems will not help us solve them.