...this is already legal for some decades. if you are in a rewards program you agreed to have you anonymized sales history (i mean, they will not list "ate burgers" but "ate at fiveguys" is pretty similar).

after that you need some magic to deanonymize the anonymized data, but in the 90s plenty of people claimed to do that already. the famous case was infact with health insurance and burgers... but i can't recall any names.

edit: in the usa