That’s illegal under CCPA so if they did that to the data any California resident they would be in big trouble. More or less any transfer of data for which the company receives some benefit counts as a “sale” under CCPA.

https://www.clym.io/blog/ccpa-selling-and-sharing-what-count...