I disagree, especially because "other than necessary" is a pretty squishy concept (i.e. selling tailored ads could be considered "necessary to operate a website"). Instead of that, I think selling or providing any form of data collected without the customer's explicit consent (and to consent, the customer must know what data is being s hared) or without a warrant (and only the data in the warrant) should be illegal.
That should be sufficient and actually enforceable, since it has very clear boundaries on what's included.