I guess I was wrong. My impression was there are restrictions on the exact terms of how you can exchange your data with companies.

At the very least, my original statement was overly broad.