Your second paragraph is false, AFAIK. In the USA, credit bureaus are legally allowed to sell lots of your info to debt collectors and financial service companies. (According to DoanLaw.com) this is why you get “prescreening” offers for credit cards, mortgage refis, etc.
- HIPPA is for health care providers and their vendors
- Traditional wired telecom has long been protected. And fraud over telecom has a special wire fraud statute.
- Mail thru the USPS
- COPPA for PII of under 13 data
- Federal election law prevents election records used for commercial purposes
- basically all of the government classified data system
Famously, Experian ("freecreditreport.com") sold partially filled form information. This is before submission and up to 9 times. Feel free to go to the site signup today and watch the information being streamed (in a hashed form) from your developer console.
Your information is not broadcasted to all companies in existence only those who you've authorized (or have been authorized on your behalf by a malicious actor / identify thief).
This is not udp.