It is opt-in if you pay for it, but almost no one leaves it unchecked. There's also the option to not require an email for free downloads.
Often these are people I've sent from somewhere else, and we talk regularly. It's not like with Facebook where it's a faceless corporation unless you're spending enough on ads to get an account specialist.
They generally knew me before they gave me money. I'm not collecting any data on them other than the email. I don't even run analytics on web pages I control. I wouldn't even know what to do with it that would tell me anything I don't already know, or that I couldn't get by just asking.