The frustrating part is that since so many companies collect PII under the guise of security (and then use it for advertising) it's harder to tell if this is a legal scam or illegal scam.