This feels illegal. If it's not, it probably should be.

It should be, but the last time the US got new privacy regulation it was because an employee at a VHS rental store embarrassed a member of Congress by telling people what movies he'd rented.