There are firms that specialize in advertising data. If you're wondering where you information goes when you signup for your grocery store rewards programs, it's those guys. You usually can't buy a particular user history, it's usually in bulk. This is just standard practice, no government organization is placing rules on it so we'll see what kind of inevitable abuse stems from it.