Even having an account at all, and being able to see that I have a subscription, or that I previously watched that video, is personal data they collected.
So the Privacy Policy is what you “agree” to let the company do with that data. How do you even begin to differentiate the superfluous stuff they track just for ads, on a technical level without workarounds?
And then think about banning “transferring personal data to a 3rd party.” Does that mean I can’t host account data on AWS, or use a hosted database, be causing I’m transferring data to a different company which can presumably also access it? That’s what the privacy policy has to allow, and why sites have so many “partner services”
I worked for a major adtech company that bought zero third party data.
There's enough in the bidrequests.
And we had nothing on Meta or Google's ecosystems.