OK, but is Google's ability to "share user-specific data" with an credit-reporting agency or any high-enough bidder, merely a matter of changing a policy clause

OK, but is Google's ability to "share user-specific data" with an credit-reporting agency or any high-enough bidder, merely a matter of changing a policy clause and turning on the spigot?