While the document discloses extensive third-party data sharing and includes some protective measures like session-only biometric storage, it lacks granular consumer controls, explicit purpose limitations, and statutory privacy rights disclosures.