At some point there are going to need to be verifiable, transparent, secure, auditable etc. standards for exactly how data gets used after it goes to someone's servers, not just a vague privacy policy.