> Actually, the regulatory language is easy. "You may not buy or sell user data." I believe the easy workaround is to designate the other party a "data process

> Actually, the regulatory language is easy. "You may not buy or sell user data." I believe the easy workaround is to designate the other party a "data processor" or something of that sort. "We're not selling data, we merely allow partners to access it to generate reports for us."