I believe they can also sell the data, though there may be some regulations on anonymized, or sold as a group to develop profiles and understanding for advertising purposes.

Perhaps that's what you mean by "mass surveillance", but I took that to mean specifically government surveillance.