Haha, yes. For GDPR they used the joint controller framework to assert rights over the data but not responsibilities, which stayed with the first party. Almost beautiful if it weren't so evil. So I'm trying to think of their CCPA jerk move!
♥ 1