customer “convenience” and privacy intrusion

Where do you draw the line between customer “convenience” and privacy intrusion? For example, when Netflix recommends movies based on what you already have seen, most people regard that as a benefit. But if Netflix had a parent company with other divisions, would you want your data shared without your consent? Is it legal to do this? Support your answer.