I don't think reputed companies like Coinbase UK, Ltd. are engaged in illegal activity of selling users' KYC data. All such companies maintain 'Privacy Policy' statement and breach of such statement can land them in big danger.
There is a trend going among crypto-based sites recently, they are paying users some amount as a token of appreciation for KYC Verification, for example, Blockchain.com is paying $25 in Stellar (XLM) for KYC. I think such giveaway is having negative impact on their reputation. People are believing that such websites are buying KYC data like you mentioned. But the reality is law requires them to do so. All such websites should adopt the Bittrex policy. Bittrex straight away limited the account of users who didn't done KYC and had no reward policy for KYC Verification.