The only rule is: What a company <i>can</i> do and what they <i>can&#x27;t</i> do. If it&#x27;s possible, assume it&#x27;s being done and protect yourself accordingly (i.e proxies, blockers, host files, etc.)