If they sold it, isn't that like what... literally almost every single company does nowadays unless you pay up?
It's quite literally the difference between exposing a public API and actually handing over the contents of the database.
Both are real violations of users.