Some projects, such as exchanges, need to carry out KYC to ensure legal provisions or limit "virtual investors" in market. However, just as you say, there are projects that abuse KYC to collect and sell user data, so each should be careful and carefully check each project which want to join.