[narrowrail]

The only rule is: What a company can do and what they can't do. If it's possible, assume it's being done and protect yourself accordingly (i.e proxies, blockers, host files, etc.)