[xxs]

> embed a third party on my website, all bets are off considering privacy/data flow.

That's definitely not the case. It'd be true only if there is no contract w/ the 3rd party at all. Many contracts cover data leaks and the like and the contractual obligations are "non-trivial" to put it mildly.

[KingOfCoders]

Then our experiences differ somehow. Most Disqus users don't look like they have a contract, rather they accept terms and services than can be unilaterally changed by Disqus.

I've signed some DPAs and those that I've signed were very vague and liberal on what data they take - at least none of them felt that they would not try to get all the data that they can.

[skinkestek]

> Most Disqus users don't look like they have a contract, rather they accept terms and services than can be unilaterally changed by Disqus.

In that case the terms are invalid.

You cannot use terms of service to take away consumer protection in Europe.

[KingOfCoders]

Yes.