Certainly seems like theft to me. Just because computers spew ridiculous amounts of PII does not mean company xyz llc has a right to collect that information or to use it for anything without educated and explicit opt in disclosure that verbosely enumerates every single instance in which said PII will be used between the time of collection and the heat death of the universe.

'server logs' fails to account for how that data is used which should explicitly defined. Failures to do so is misappropriation. A good litigation firm couls retire by challenging reckless companies on these grounds.