That's a really valid point, especially if they agree not to collect additional personal information...

My guess is that they kind of have to because they have an agreement with the 3rd party that's handling this.