Any behavior or opinions they expressed, true or otherwise, would have built that mental model, and thus with implied consent by providing the information to them. If you provide information to someone, you are giving them consent to collect that data. The retention and use may be implied or explicit. Such as, if I told you "My luggage combination is 12345", I have consented to you collecting that information. There may be an implied expectation of you using, or not using that combination.

The key thing to understand about what is being discussed is that this is all with regards to an expectation of privacy. Such as, I buy product X and store Y every Friday. I have a reasonable expectation that store Y will not tell anyone that asks that I buy product X, or that I buy something every Friday, or that I buy product X every Friday.

This expectation of privacy is after having entrusted company Y with that information. An employee at company Y could suggest product Z to me, having seen me purchasing product X repeatedly. This is not an invasion of privacy as the information collected was with consent (I provided it to them), however, it may be a misuse of information collected, depending on any standing agreements.

However, if served with a subpeona, I should have no expectation of company Y withholding information, just as I have no expectation of preventing a search of my home if I was presented with a search warrant (providing the subpeona and warrant provide in them the necessary scope).