There are no limitations on what these parties can do with the data they collect or where they can transfer it