Ok. If I take 100 dollars off you each month until the police stop me. Stopping me is punishment enough because I lose revenue.
Talking money off you and taking your data and selling it on is different, but both are wrong and both should come with a punishment. Not just an order to stop.
In the EU they wouldn’t have tried this in the first place, because they’d get fined.