I wouldn't be surprised if they did audio fingerprinting. But even if they don't, the third parties who are buying the data can easily re-identify the users by doing data fusion with other sources (smartphone location data from other vendors)