For example, a casino could lure people onto depositing and because the KYC policies, they would slowly gather information, since they already have the email of those victims; then it is a personal profile which is of interest of targeted advertisement providers.
So, they earn money from both abandoned funds of those who decide not to withdraw and also from those providing documents.
The ones that actually sell user information generally execute such operations very carefully in an extremely secure and private environment.