Most likely all of it. It is usually laundered through startups and other types with little to lose or who put little effort into reading or complying with legal agreements. These companies then sell it to more legitimate companies who don't realize where the data comes from and it all just ends up in a bunch of big databases that sell access to whoever wants it.