Yes. Once you give your data over to a 3rd party, any privacy or adherence to legal process is benevolence on their part. There is nothing (in the US) that requires them to treat (most) data as private information.