Some consumer websites say they will not sell users’ data, but unrestricted-data clauses allow them to transfer it if a merger or other transaction occurs.