It is. They mention in their privacy policy that they may disclose anonymized histories, so they might have a decent legal leg to stand on.

I don't think this helps them much in court of public opinion, and it helps even less in not pissing off a segment of their customers. Making it opt-in seems like an easy compromise. The only downside I see is if they get a really low response rate.