I think AT&T is the second one to admit that they do that and then charge you money to get out of it. The first was a small local ISP that didn't offer any way out and quickly backed down after pushback from their customers.

Chances are the other American ISPs do it, they just burry it in the terms of service. So AT&T figured out they could make some extra cash off of their privacy conscience customers who don't know how to use VPN.

And chances are they still collect and aggregate the data, they just don't retarget you specifically.