All of the coverage regarding the Penlink stuff is saying these app developers "didn't know" and that's infuriating to me. Like if you're integrating an SDK, you have to know your users' data is being bought and sold. They just didn't know that the gov't was buying it, they definitely knew that they had access. It feels like a cop out, and there needs to be some accountability in controlling your users' data lifecycle.
This is why reassurances from developers or software houses that data their products collect remain "private" are meaningless.