I can't speak to all business models but I don't think what you're describing is unheard of. I think that the principle of consent applies, no matter what the context. So if the information that's being collected is to be passed on to a third party, that consent is required by the legislation to be explicit and informed.
