It doesn't even have to be malicious, it can happen accidentally. If the entire company is based on advertising and privacy violations then it's hard to truly have "private" data without building an entirely separate system in parallel, otherwise you could put your data in a place you think it's private, not realizing some other component of the system will use that for ad targeting.