This is one more reason sector-specific privacy expectations probably need to be harder-coded. Hoping every consumer app will independently exercise restraint has not gone especially well.