Anywhere that collects your phone number in exchange for coupons at the checkout (cough cough Old Navy) or your email to send you a digital receipt (looking at you Home Depot) is probably sharing or selling your data.
OTOH, ubiquitus digital receipts would revolutionize automated plain text accounting for individuals.
Not probably. They're certainly selling your data.
Unless you are in the EU, where it's illegal thanks to GDPR.
True. I'm being US-centric. Even though I consider the GDPR to be a bit inadequate, it's orders of magnitude better than what we have in the US, and I'm jealous.
I hope Home Depot made a pretty penny off of selling my email address, which is homedepot@mydomain and not associated with any other accounts.
Nobody has perfect opsec, and if you screw something up ONE TIME, like leave your phone's bluetooth on ONE TIME, now that super simple email address is added to the profile that these groups have on you.