In my opinion, training models on user data without their real consent (real consent = e.g. the user must sign a contract or so, so he's definitely aware), should be considered a serious criminal offense.
replies(5):
(and as diggan said, the web isn't the only source they use anyway. who knows what they're buying from data brokers.)