As long as the data is aggregated, it should no longer contain any personally identifiable information. Only "W # of people browsed to X url at Y time of day or Z number of times". Of course, there's no guarantee that it's done in this manner.
I think we should be left out by default and opt-in by request in exchange for something... maybe a free service, a free router/firewall or a credit against the service fee...Why should they be allowed to collect data on me, without my consent and then make money from it?
My guess is we probably do opt in when we sign their Draconian EULA.