At least in the US, all delivery services like FedEx, UPS, DHL, USPS, ect. all just drop off the package and email you a pic of of it and the area around it. So do local retailers offering home delivery such as Walmart, Homedepot, Kroger, etc
At the very least.

Things are different in other countries.
"To collect a shipment addressed to an individual, the recipient named on the waybill must provide:
a valid Russian Federation national passport or a valid Russian Federation drivers license (for citizens of the Russian Federation);
a valid international passport (for foreign nationals).
Individuals not named as the recipient for a shipment addressed to a private person must provide:
a written power of attorney from the recipient;
a copy of the first page of the passport belonging to the recipient named on the waybill;
the passport of the person named in the power of attorney."Source: https://express.dhl.ru/info/spravochnaya/ Everywhere, need a passport, and passport, and then again another passport.
Online orders are shipped, and the shipping needs information, the name and the destination, so it is not actually the typical KYC but information about the buyer- who and where.
Officially, this is not KYC, but it exhibits suspiciously similar characteristics.
They keep this for future use or it is also possible that they sell this information to other party. This deal of selling has an NDA to keep secret that they are selling information. It sounds absurd, but it is really possible.
But does the client actually consent (without it being forced upon them via the user agreement) to having their data used by the company they are a customer of, or by third parties who have purchased that data?
This is, in fact, a real possibility (and not at all absurd) since we have no way of knowing about such deals (as you rightly pointed out, due to NDAs). That is, unless theres a leak revealing these deals (deals involving the sale of your already-leaked data, that is

).
We don't know for certain whether the HW-manufacturers of might be selling their customer's personal data (either officially or through the actions of corrupt employees). Although, theyre (keystone) effectively doing it
for free (thanks to hackers and leaks).

If they are not collecint DATA from customer, then why are they keeping them.
They are waiting for the right moment to leak this data (whether voluntarily, by selling it, or by waiting for hackers or company insiders to do the same).
