I think vendors now need to put a "agree and disclaimer" to check before purchase (or end user agreement etc) that profiles CANNOT BE RE SOLD.
This won't help at all for 2 reasons:
1. Criminals don't care about disclaimers, 99.9% of them won't ever check or even see this disclaimer cause they don't actually buy the products from the original source.
2. Software products (licences) can be re-sold (transferred) at least here in Germany. The disclaimer doesn't matter and doesn't change the legal situation.