Like it or not, modern society is a surveilled society, and that includes the private, capitalistic parts of it.
All the data is there for capture, and the tools are available to analyze and sell it for profit, and as a source of revenue it matters not whether primary or secondary.
What's lacking are rules governing how far the hoarders can go, and what they do with that information, especially in the U.S.
Survey the scene after pulling into a store parking lot, and see how many cameras you can count outside, on the way into the store, and inside the store. The radio beacons tracking your phone pings and movement through the store are present, but not visible.
Their turf, their rules, yes, but it's heading toward a point where an EULA might be appropriate to outline what the terms are to enter and shop in a store. Not that it would matter, since most people just click through them without hesitation anyway.
In the past, make a random in-store purchase at a Home Depot, and if the card used as payment is on file for one's account, they will solicit you to write an online customer review for that item. They didn't even need to see any form of ID to link it to you as a customer. They knew based on the incidental, and non-explicit usage of your payment card, and assumed you had already granted consent to be contacted, and bothered to write a review.
In the overall scheme of things, an minor, if annoying (for many, based on the reviews people leave) practice, but it does illustrate the extent to which companies will go.
Practices like that are relatively easy to spot, but what about the other stuff that isn't? It's a free for all, and that includes the government agencies that purchase information from data brokers as well.
