Good luck enforcing shit in a US court against a "private enterprise" and you sure as fuck can't count on any regulator here for anything beyond some good lip service.
Smart move is to go based on how system functions, not how it supposed to work. It is likely configured for this anyway.
Use case where possible folks, they are taking it away as is.