Firms that collect transactional data are increasingly finding themselves the subject of class-action lawsuits by Americans who allege the companies are collecting and sharing data without consent.