We're hearing a lot about evil companies collecting and selling user data. But I've never seen it mentioned, how exactly does this happen?

Let's imagine I'm a evil CEO of a new startup. I pivoted from stealing candies from little children, because data seems to be hot these days. Let's also say that I have a successful mobile app doing whatever, and hundreds of thousands of clueless users who let it siphon their location data and browsing habits reguarly. How do I get from that point to earning $$$? Do I put the data for sale somewhere? Do I call an ad company to arrange a meeting in a dark alley to get a quote on my dataset?

--

To be clear, if it isn't blindingly obvious - I'm not in support of such business. But I'm trying to understand how deals like this work, how the ecosystem looks like. That free services "sell your data" is a popular trope, but who exactly do they sell to? How much money they make? How is this not illegal? Who to boycott?