You need a reputable third party to audit your practices. Or your software needs to be open source so anyone can see what you're doing.
I'll be switching from using DDG because of this. I don't trust Yahoo, and I barely trust DDG.
> A privacy-respecting, hackable metasearch engine
I think the point the previous poster was making is that even though it's regulated, there are so many black boxes that it's rather easy to sneak in a violation and no one notices (whether the company is doing it or it's accidental). Just look at how many organic product recalls happen in any given year due to various causes.