The difference, as usual, is: consent and control. 1. the user did not provide affirmative informed consent (it was buried in a ToS doc that nobody reads) and 2. the user has no meaningful control of the sharing.