"The ‘sale’ and the ‘service provider’ situation are two huge loopholes that companies are at the moment exploiting," says Justin Brookman, the director of shopper privacy and know-how policy at Consumer Reports.