I would guess that there are 3rd party companies who's business is to match cookie values behind the scenes to email / phone / address / demo data and re-sell it, or sell access to the aggregate db.
Hopefully a federal privacy law will clarify if this is legal at all.
Hopefully a federal privacy law will clarify if this is legal at all.