They can still be bound by what their privacy policy states. For example, AT&T is pretty open and clear about what they do with your data (a lot). https://about.att.com/privacy/full_privacy_policy.html