No one (here) is arguing there's a legal basis for it, but nonetheless it's happening. AOPA has started to make a little noise and there's a bill in Congress right now that's supposed to touch on GA privacy, and by extension, prevent capitalizing on ADSB data.
You can restrict your data through the FAA website, however that doesn't prevent the already existing third party commercial databases from being utilized, since they've already pulled all of the data from the FAA. If you do lock out your information, it will take time for it to be culled, basically not really happening until you sell and/or buy a plane and the ownership info isn't updated in the third-party databases.
I've intentionally not restricted my data because I find value in allowing my parents or friends to be able to track me when I come to visit. It sucks those are the only two choices we have.