Yep, the saying is generally that if you don't pay for something, you're the product.

But I've noticed that more and more, even when you do pay for something there's a good chance your data will still get sold.