From my observations, for data vendors "anonymization" generally just involves replacing a name or credit card number with some other identifier. That's the reality and that's all they are required to do by regulators. People on both sides of the market know and leverage this. There are legitimate use cases that people are after that can only be achieved by having the ability to correlate pseudonymous entities with some kind of history. Lots of data sets would be significantly less valuable, and lots of industry standard analyses unachievable with those identifiers out of the picture. As long as there is no Personally Identifiable Information (which, no, metadata, location history, medical claims, transaction details, don't count). I would imagine that this is something regulators are aware of and that the privacy tradeoff has just been shrugged off so that the market can carry on and do its thing.