The upcoming EU privacy rules should stop this kind of behavior. It requires companies to explain exactly how user data will be used and not hide behind a generic EULA statement such as "anonymized data may be used to improve our services".