"Do we ever record any personally identifiable information? No. Do we ever sell or distribute this data to outside parties? No. Can any of this data ever be used maliciously? No."

The answer may be no for now (that you know of). You can't guarantee that it will stay that way forever. Given Pincus' general shadiness to make a buck, I can totally see a slow quarter or two driving a decision to "update" the privacy policy to sell data to 3rd parties.

Similarly, it's not a big programmatic change to start tracking PII as well as cross-referencing to existing information. So while you may not have any ill intentions, I doubt you can speak for all of Zynga's actions over time.

I would emphasize the "over time" component since it tends not to be taken into account by most people which is a big reason why we are being bombarded by SOPA-like legislation. (Didn't win this one? No problem, we've got ACTA, etc. And should ACTA fail, I'm sure there's something else over the horizon)