As a European citizen, it is illegal if they share my personal info to other private third parties without my explicit consent, and it should be that way everywhere.
Even if it is illegal, there is no way you can be sure that companies don't do that behind closed doors. I've seen many cases where personal data got leaked by some apps licensed by the government for various reasons in many countries, even if there is a clause that makes it illegal. Maybe you can encourage your government to punish them, but the cost is not worth it for most users. I believe this is the major reason why people want non-KYC services to begin with.