[kanobi]

But the problem is how can consumers really know if the company is selling this data and to who, without some kind of legislation? Being a premium product is just an indicator, but it's not definitive.

I think even CCPA in California should be able to prevent abuses like that. At least you should know what data is being sold and you should be able to opt-out. If that's really the case, only time will tell.