Consider reporting this to your State and Federal trade commission and privacy enforcement entities. Moving forward it's likely useful to document the activity (screenshots and related, whatever is convenient) then followup to share the documentation with these groups.