* The data will never end up in some law enforcement database.
* The data will destroyed in a timely fashion (say, after six months).
* Access to the data will be severely restricted. As in, to specific individuals--not whole departments or entire organizations.
* The data will not be aggregated or conjoined with any other data they have about me. Ever.
* Any data collected in this way must never be allowed in a court of law.
* If the data is ever shared all personally-identifying information must be redacted or removed.
These things are much more important than limiting the liability of the company that shares the data. Get your priorities straight!