See (for U.S.): Library Bill of Rights - Wikipedia ; Library Bill of Rights | ALA ; Privacy: An Interpretation of the Library Bill of Rights | ALA
It’s not an actual law, however.
Forty-eight U.S. states and the District of Columbia do have laws protecting library patrons’ records to some extent: State Privacy Laws Regarding Library Records | ALA
A concise historical timeline re U.S. libraries from the 1700s into the modern era, privacy stance, and government responses to perceived threats: Historical Overview – Data Privacy Project
So one might not think that one’s reading (or listening) would be subject to commercial exploitation (at least). If only that were true!