1. Lists of people who have purchased [music genre] from iTunes & listened on Pandora is for sale by data brokers, and
2. App developers (they specifically call out Pandora) who use the MediaFramework API have access to iTunes library metadata that they can then collect.
I haven’t looked at Apple’s Developer Agreement recently but I suspect Pandora (and potentially others) hasn’t complied with the terms.