"on-sharing the data with cross-site aggregators"? The ToS and Privacy Policy of an analytics company discloses what the that company may do with their client'

"on-sharing the data with cross-site aggregators"? The ToS and Privacy Policy of an analytics company discloses what the that company may do with their client's users' data, not what the client can do with their own users' data. There's another Privacy Policy between the client and the user where the client discloses what they may and may not do with user data and the user decides whether to become / remain a user. There are also laws which dictate the data handling further on behalf of large groups of users, e.g. GDRP for EU citizens and, on this side of the pond, interesting Supreme Court cases being decided about what kind of data users could have property rights to: https://en.wikipedia.org/wiki/Carpenter_v._United_States https://en.wikipedia.org/wiki/Carpenter_v._United_States