The bigger issue is whether users feel they have clear, informed control over what's collected and who can access it