Even so, the rule should at least only apply to data that was solicited. If you intentionally send data that was never asked for, through a channel not meant for that data, you shouldn't expect it to be treated the same as data that was collected through normal means.