Buying data lists. You usee your mobile number to get your cinema ticket - or whatever - the cinema sells that data. Do you get package alerts when you have a parcel due, now your phone number is joined to that address, plus presumably the credit card companies sell their data (?).
Companies amalgamate that data, then sell lookups of varying degrees.
Screwfix in the UK gather a lot of personal data as part of their sales process, they're the least covert about data gathering I've seen.