> Data can either be not-shared, shared to service providers with contractual obligations [...], or shared to service providers who may then use [...]. To foll

> Data can either be not-shared, shared to service providers with contractual obligations [...], or shared to service providers who may then use [...]. To follow up, this distinction is also made by both GDPR in Europe, and CCPA in California. (In fact, CCPA uses the same term "Service Provider" and I wouldn't be surprised if that's where Google got it from.) Still, both GDPR and CCPA require disclosure of Processors/Service Providers. Transfers to a Processor/Service Provider have restrictions, and that's significant. Such third parties are treated differently under the law, with those restrictions removing the need for other safeguards. But the don't entirely remove any risk. Ultimately one of the goals of these disclosures is letting the user take control over how their data is used and distributed. Some users (including you, and including myself) are comfortable with data transfers that are protected by legal safeguards rather than technical ones. Some are not comfortable with that, and have valid reasons to be. Some users reasonably want to know their full security risk exposure, which means being aware of which parties are handling their data. Some users simply don't want to do business with certain platform providers, even indirectly. I'll also point out that the EU has found that US safeguards about transfers to Service Providers are inadequate, because if a third party has your data that means US law enforcement can get your data from that third party. So there are very valid concerns that the safeguards Google considers adequate for a Service Provider may not satisfy all users. All of which is to say, I agree that the distinction about Service Providers is useful and meaningful, but I think it is the wrong decision to exempt Service Providers from being listed altogether.