I was under the impression that e.g. phone carriers in the US fairly freely sell that kind of data to whoever pays for it, and can do so legally except for less than a handful of states states with useful general privacy regulations? (general in contrast to sector-specific ones like HIPAA)