Yes they can. Yes they do.
Generally, they sell information in the order of risks. Apply for loans and credit cards- highest chance. Large volume CD and deposits - lowest chance (they want to keep this business in house)
Loans highest chance of your information getting cross sold. Especially if the bank doesn’t have cross products. E.g. if a bank offers home loans, but but not credit cards. If you get approved they might offer you a credit card as well, but from a different bank.
The terms are usually laid out in the privacy policy and T &C, most will allow you to opt out.
However, it may not always be a bad thing, if you have good credit scores and low debt, banks compete for your business. If you get a banking product like a car loan from another bank, your own bank might compete for that same product with better rates.
Back in the day, when I was in retail operations, I did all of this manually. If I saw a lot of checks from a customer’s account going to pay credit cards and bank loans at other banks, I would contact the customer and offer a competitive rate. Of course today you can mine all that information.