Are people really surprised when they hand their location off to a domain that any other part of the domain might have access to it? Like, taking away the technical specifics of how location allows actually works, you’ve given the data to the _company_. At the very least, they throw it on an internal service and allow other parts of the company’s infra to grab it.