It sounds like the organization might not have been aware that this fundraising tool was doing this, that's even worse. They think they're providing a service to people and raising money meanwhile the people they're helping are unwittingly being tracked - who knows how this information could be misused by insurers/employers/etc etc.

I wonder what recourse the organizations could take? A lawsuit? Going to the media?