This is framed with OSs in mind but the place where this actually happens the most is mobile apps.
It's difficult to protect your contact info when everyone with you in their contracts gives access to candy crush. It's the one I see the most and know who does it because those people will show up in the "you might know this person" shit.
Despite strenuous efforts, I still get ads using my private information (like I told my friend in person I needed a charger for a specific brand of vacuum [I needed the charger for a piece of random equipment but found that a Dyson cable worked and wouldn’t be $100] and next thing you know I’m getting ads for Dyson and vacuums in general).