Haven’t you seen those Apple ads? lol
There already is a law. It’s called the Privacy Act of 1974 Codified as 5 USC Section 55 et al. and it makes it a crime to sell post or otherwise reveal personally identifiable information about anyone for any reason to any third party without proper written consent.
The problem is that courts (not congress but courts) have interpreted proper consent in a myriad of ways never intended by the authors of the Privacy Act of 1974 and so we have a hodgepodge of precedent that will back up dataloss unless said dataloss begins affecting millions of people.
That is starting to change however and Facebook, Google, Apple and a lot of other companies are likely in for a very rude awakening in December if the High Court takes up one of the Privacy Act cases slated to come up in October or November. At least one of those cases speaks directly to the issue of proper consent, and if it is ruled on to reverse the 9th circuits ruling (more likely now that Apple v Pepper has been decided against Apple) that case will cause apps like the one here to become a thing of the past as proper consent would mean an informed (and not by boilerplate fine print) consent.