Keep in mind that it's analyzing their privacy policy, not their actions. Who a company specifically choses to share the data with and how often they do it is likely not considered.