There is a possible argument that selling an ad that will use PII to target consumers to a 3rd party advertiser constitutes a “sale” however.

We should not ever expect the government of the place where Google and Facebook are headquartered to do anything meaningful to protect privacy. To do so would destroy the business model of these companies. Why would they ever want to do that?