They seem to count CDNs as "hosting providers" and yes, without the necessary legal frameworks in place, this is also a problem if that leaks user data: https://www.technologylawdispatch.com/2021/12/privacy-data-p...