I wouldn't say that this implies they really are selling user data. By that definiton of sale, I can understand why their lawyers would consider it almost impossible to fully comply with.
I totally understand why the Act would use such vague wording and cast such a wide net, considering the underhanded actions of ad companies. But I also understand no longer feeling comfortable guaranteeing that nothing that could reasonably be argued to fall under this definiton would ever happen. Heck, I think some lawyers might argue that even just sending an anonymous GET request to any web server would qualify (disclosing personal information to a third party). Seems like the only way to stay fully compliant is to ship a browser with only an offline mode, haha.
I totally understand why the Act would use such vague wording and cast such a wide net, considering the underhanded actions of ad companies. But I also understand no longer feeling comfortable guaranteeing that nothing that could reasonably be argued to fall under this definiton would ever happen. Heck, I think some lawyers might argue that even just sending an anonymous GET request to any web server would qualify (disclosing personal information to a third party). Seems like the only way to stay fully compliant is to ship a browser with only an offline mode, haha.