I knew a guy that started to fill out a shop form (card entry), and didn't submit.

They charged the card anyway (and did not send any product).

They got an earful from him.

I suspect their form was a piece of junk, but that doesn't sound particularly PCI-compliant, to me.

This ad-targeting, email-harvesting thing is really bad, though. It may not be illegal in most of the US (but I'll bet it is in some states), but I will lay odds that this company had better make sure they don't have any EU data mixed into their little bouillabaisse.