I had a friend on MSN messenger who I knew in real life, we'd never connected on the internet in any other way whatsoever so the only way to link us was via MSN.
I was on LinkedIn but only with 10 or so contacts, all of whom were recruiters and had no common links between me and my friend on MSN.
One day when I logged into LinkedIn it suggested my friend from MSN as a contact, given that the only way to link us was via MSN it was clear that long before MS bought LinkedIn it was engaging in illegal data sales/transfers with LinkedIn and LinkedIn was willing to buy/accept illegal data too, and use it to try and grow it's business.
It seems that pretty much all big tech companies violate data protection laws. The law just seems to not get enforced against them.