I’m going to assume this judge hasn’t been unduly influenced.

This looks like a classic case of following the letter of the law, while ignoring the spirit of the law. The law seems like it’s intended to punish harmful violations of privacy. No reasonable person can conclude that the sale of tens (or hundreds) of thousands of people’s private data is entirely harmless, but that’s what this judge did.

US courts often take “reasonable” assumptions into account when making judgments or issuing sentences. Just because the plaintiffs couldn’t actually prove specific damage is no reason to assume it didn’t/won’t happen.