I'm confused. If these rules that were repealed never went into effect, or only partially, does that mean that our data was already (or is currently) being sold?

Does this legislation explicitly condone the collection or sale of browsing data? (I'd still rather have the protection than not, but can't seem to find a good detailed explanation.)