Can't really fault them for not disclosing their datasets etc. Without meaningful protections it would be a huge legal liability.