It isn't clear where the data comes from. A business in a non-US friendly jurisdiction can make an online business selling black market data in a way that looks legal to data warehouse groups who in turn sell it to the company using it. Once you get to the actual company using the data, there is no indication of it being black market data. The middle company, if it is buying enough data, only takes a few employees who care more about getting the data than verifying the ethics.

It's kind of like arguing a bank would never create fake accounts because the risk of doing so is too large.