These risks apply to every Uber product. They are legal obligations and corporate practices that individual products cannot override. A subsidiary cannot opt out of an FTC consent decree. A company cannot selectively ignore its home country's intelligence law for one product. These risks set a grade floor of B — no Uber product can score better than this, regardless of its own privacy settings.