Yeah, often companies will make that kind of claim based on the fact they only pass around sha256 hashes of email addresses, which are trivially deanonymized.

https://freedom-to-tinker.com/2018/04/09/four-cents-to-deano...