Few years ago i worked in security software company (antivirus, firewall etc). We collected almost all possible data about users. You can imagine what kind of data...system uptime, configuration, web searching history, even bank payment details.

From those days i am not surprised with this practice.