If they were only selling data in such an 'innocent' way, couldn't they clearly state that, in addition to whatever legalese they're required to provide?