I mean, there’s more privacy protection on payment data than there is for email address and browsing habits. Plus most companies just push out payment handling to stripe. So most websites have little idea who actually transacted with them to begin with (email dependent).