It could be as simple as 'using data that the user did not explicitly opt-into sharing'. Agreeing to terms&conditions doesn't count as it is not explicit.