Is that true?

Off the top of my head I think GDPR in the EU might have something to say about this. I don't know if those protections exist anywhere else or not.

In the US, people get very upset about things like traffic cameras, and public surveillance in general. Those are usually data-for-punishment vs. data-for-profit (...maybe?), but people here resist things like data recorders in their cars to lower car insurance.

At least to me, being unhappy about Niantic's behavior here does not seem the least bit unusual.