A company which requires your phone number for 2FA can also use it for monetization, if it's in their T&C (that you read before accepting, of course). Like sell

A company which requires your phone number for 2FA can also use it for monetization, if it's in their T&C (that you read before accepting, of course). Like selling it to advertisers, using it for targeted promotions and whatnot. Another reason to ditch this transport system. 2FA is about combining a thing you know (password) with a thing you have (physical device like a card reader for banks, but usually phone because easier to access). But you can also use something you are (fingerprint/face recognition), although that comes with another entire set of issues (like sending your biometrics to a server).