content: Problem is not with first parties, though this is old news and dead common. Third parties like google, adobe, oracle, experian, IBM, etc sell their products to most websites, so there is a third party a customer didnt enter any contract with that has access to the web history and behavior. If Google tells a judge you visited jihad.com and looked at bomb recipes, how are you going to defend yourself? If Adobe knows Trump has a capitalOne account, logs in daily, they can inject basically whatever code they want into his experience, steal his credentials, move his money, blackmail, hide a cp link under a commonly used button, etc I work in web analytics.  I was asked to add an Experian "harmelss piece of code" to a banks website.  1 month later Experian is hacked and criminals have all of the bank's customers info, at the very least.