Companies can legally sell your personal information (home address, name, etc) to credit reporting agencies.

https://www.dwt.com/blogs/privacy--security-law-blog/2019/05/exempt-or-not-exempt-part-2-the-california