An article in NY Times does not help to make it less hidden, particularly for German users. What is required is to inform every user individually and ask for his/her permission to transmit the data to another party. Explicit permission (= informed consent) is necessary because this data transfer is not required to perform the service (see above).