Looks like they keep on charging card on file for Domain privacy even after you have turned it OFF, sold or transferred the domain. I was just charged for 31 Domain Privacy for some of my domains at Dotster - however, I only have 6 domains with privacy on them, and only a total of 17 domains with them. Pretty bald of them!
Here is what their billing rep said:
***************
"Hello Oy,
I'm extremely sorry for the inconvenience. We have not received any prior request to cancel the 'Domain Privacy' product for the expired/removed/unused domains. This is the reason, these additional products were remained active in your account and your credit card was charged towards the renewal of these products as the domain renewal and products renewals are two different entities. To cancel the additional 'Domain Privacy' products, you will have to contact us.
I have now canceled 25 additional 'Domain Privacy' products from your account and refunded $324.75 ($12.99*5) to your credit card which was charged towards the renewal of 25 additional 'Domain Privacy' products in the year 2015. It generally takes seven to ten business days for your bank to post the amount to your account. Unfortunately, we will not be able to issue the refund for the past years charges.
Going forward, your credit card will not be charged automatically towards the renewal of the additional products.
If you have any further questions, please update the Support Console.
Sincerely,
Mounesh K
Billing Specialist"
****************
So if you have domains with Dotster and drops, sells, transfers or just removes Domain privacy - they WILL continue to charge you for them anyways. Interesting business model. 
***