The American Library Association specifically discourages the behavior of your local library:

http://www.ala.org/advocacy/privacy/guidelines/library-manag...

> For example, if the LMS offers the ability to save the checkout history, this should be an opt-in feature not turned on as a default.

The policy also recommends libraries minimize collection of data in general, use HTTPS whenever possible, and maintain a warrant canary.

See also: http://www.ala.org/advocacy/privacy/FAQ