City is not considered personally identification data. So no law applies to it. Anyone you buy your dildus from can sell data based on city and size. Just not your address and name.

The sales numbers and distribution etc is considered their data not yours.