If you live in the US and don't use cash for every purchase, I think you'd be surprised how much leeway companies have here. Many logical and straightforward protections won't ever be put into law until after some new privacy crisis comes up. This is one reason why it was so infuriating when google and apple were called in front of congress but AT&T and other cell companies were nowhere to be seen...I assume Congress is OK with that data collection (if they didn't collect location data, who could they subpoena?) but it would have been nice to at least get some of that breathless blog and news coverage aimed at the telecoms.

The hard part is disambiguating customers (which is why loyalty/discount cards are so great for them), but it is really horrifying the amount of credit card history, demographic data, grocery store purchases, prescription information (seriously) etc etc that companies can collect, cross reference, and sell while staying within the law.