We just have to look at the recent news about 23andMe planning to sell all of its user's data to whoever buys it. Sure, they can have a privacy policy and all that, but does it really matter when the company can be sold and they say "all previous agreements are null and void, your data is ours now"?