The difference is that they can't legally collect data _on americans_, so they need to outsource it to private companies. Non americans have no rights so they can just spy on them (through the cloud act for example).