I'm not down with the beating senseless part, but I would say that by making a service "free" they don't get to be sloppy or negligent with privacy. There's still a duty of care, as the lawyers say. http://en.wikipedia.org/wiki/Duty_of_care