My bank uses XML for their internal tooling without even asking me. How is that even legal?

I can't even imagine all the other tool choices businesses I interact with make without getting my sign off.