The range of possibilities is literally infinite, since the data collection and aggregation typically plays only a minor role in the overall malfeasance, whatever that may be.
Typically the worry surrounding location and other PII data is that it could be used to "identify" you in some context. By analyzing where you go, they may be able to deduce your favorite bar or club. Maybe they can deduce what sort of music you like by correlating that with band schedules. Perhaps if they want to steal your work, they'll send someone to meet you, seemingly by chance, who will steal your secret access tokens and leverage that to gain access to your encrypted files and steal the plans to your super top-secret thingamajig that clearly is important for this particular movie plot. If you aren't afraid about esoteric privacy risks, then clearly you don't watch enough television.
Aside from the far-flung movie-plot concerns which so typically drive legislation, here are the risk we know about for certain. These are things that happen today:
Law enforcement and similar Government Agencies use location data (typically freely-provided by the telephone company) to follow the behavior of persons of interest. Currently there is no automatic profiling going on here; you have to be "interesting" before you'd be watched, because someone actually has to be paid to look at this data. Perhaps your picture appears on two different passports, or perhaps you received a large deposit of money loosely connected with another investigation. But location data serves as a crude but inexpensive sort of surveillance useful to determine where to focus more costly resources.
Certain less-scrupulous organizations use location data (and anything else they can grab) for purposes of corporate espionage. We know that groups tied to the Chinese government or military use techniques both high-tech and low-tech, involving people as well as machines, to "acquire" corporate knowledge, including business practices, material science, manufacturing techniques, financial transactions and projections, and very nearly anything of value. It would not be even moderately surprising to see an attack on the Ingress servers in order to exfiltrate location data as part of another more complex attack. The scope of these operations is truly impressive by any standard.
More traditional organizations use personal data to lower costs. "We know that half of our advertising costs are wasted, but we don't know which half." Correlating identity with behavior is valuable in avoiding wasted advertising: advertising tampons to men is typically a wasted effort. The more specific the details you can acquire about a person, the better you can avoid deluging him with inappropriate messages. Ironically, this use of personal information is by far the least damaging (and arguably in fact beneficial), and yet it is also the most vilified.
We like to protect ourselves against personalized advertising, not because it does any damage, but because it's the only thing we typically see. We implicitly know that personal information can be used against us and therefore there is some safety in privacy. And we believe that this information is being used against us. But we don't worry about law enforcement and we don't see the espionage. We do see advertising, though. And for lack of a clearer villain, we fortify against that.
