A lot of how personal data is collected and sold is detailed in Bruce Schneier's "Data and Goliath" (http://www.amazon.com/Data-Goliath-Battles-Collect-Control/d...) and confirms what you're saying.