You don't have to have your business model be advertising in order to be shitty at privacy.
The websites that have been the worst at maintaining my privacy were those that primarily sold physical products or medical services. You'd be amazed how many organizations broker data now.