I believe that in the US (as opposed to the EEA) companies are allowed to share most non-sensitive data with affiliates and partners as long as they tell you th

I believe that in the US (as opposed to the EEA) companies are allowed to share most non-sensitive data with affiliates and partners as long as they tell you that and provide an "Opt-Out" clause in their privacy statement. The default there is that data is shared unless you demand otherwise. If companies want to share sensitive data (medical info and the like) they also have to mention in this in their privacy statement but the clause there must be "Opt-In" instead with the default being that data is not shared.