That's not the point - the point is that this is a loophole that effectively says, third-parties can do whatever they want with respect to your private information through our website and app and we're not at all responsible. This more or less renders the privacy policy entirely moot. It's like a vegan restaurant coming up with a "vegan guarantee" agreement that is supposed to guarantee that the dining experience is vegan, but excludes "third-party" ingredients from the guarantee. And it more or less says, you're subject to Google's privacy policy, when you visit the New York Times site, which means everything bad about Google's privacy policy is included in the New York Times privacy policy.

From a technical standpoint, what's happening is that New York Times is running arbitrary code that it doesn't know anything about on the browsers of people that visit their site. And they are claiming that they are not responsible for what it does, despite the fact it's delivered through New York Times.