Is it legal/ethical to collect and release some types of anonymous usage data without consent? [closed]

Question

The type of data I'm hoping to collect is a little specific, and unfortunately I'm under NDA and the data is a core part of the business plan so I'm not at liberty to post it online. I've come up with a similar example, so please bare with me and pay no attention to the flaws of this hypothetical service.

Say I make an online "school finder" service, where the user enters their address and the service finds and scrapes the tuition cost of all schools within say a 100km distance from that address. The service would display the list of schools sorted by price, and the user would select the school they are going to attend based on that information. They would also specify any other contributing factors, such as the aesthetics of the campus and the reputation of the school (things like this would be selected from a drop-down menu or something, a small set of non-personally-identifiable options). The school finder would passively collect this data (as opposed to actively seeking out every school everywhere and scraping the qualities of it from their public web page) and use it to both provide better search results, and also display a map centered on the user's region, representing that data somehow. It would point out, based on past usage, the most desired schools based on a number of factors (say, cheapest and most desired would be green, most desired for other reasons would be yellow, and seldom selected schools would be red).

Most of the data is just passively collected and is otherwise publicly available, but some of it (the reason the school was picked) is somewhat personal, as well as the user's home address being personal information. The only publicly visible data would be the "rating" of each school, based on a selected region. The only saved data would be the rating and cost of each school, as well as the postal code (or city, whatever) associated with that rating.

The service has no user accounts, so it's not feasible to ask every user to agree to a privacy policy for every request. Is it legal/ethical to collect and release this set of information without explicit consent?