That is the privacy policy that users agree to if they joined post acquisition (probably because Paypal doesn't expect to sell it at this time), which is differ

That is the privacy policy that users agree to if they joined post acquisition (probably because Paypal doesn't expect to sell it at this time), which is different than the policy that users agreed to when they joined pre-acquisition. They may have been forced to accept the new policy post acquisition anyway. I think the weasel is this nibble here: > but only for purposes allowed by this Privacy Policy; The privacy policy is between the user and Honey, not the user and PayPal, which implies they are still legally separate entities ("parent company"). Unless Honey has an agreement with Paypal that it can audit and enforce - which as a subsidiary, why would it want to - then once PayPal has the data, its actual use of it is governed by the privacy policy between the user and PayPal if there is an existing relationship or ??? It sounds like all Honey and Paypal need to do is find a half plausible justification from the PP for the data transfer; once it's handed over, Paypal is basically free to do whatever it wants.