Apparently my company was sending non-anonymized user data and during a privacy audit by a legal company, they really gave us a threat of being sued up the ass. And we are a MASSIVE company. I can only imagine smaller companies not realizing that.