Both I think you're responsible for your scope and also customers if they have access to APIs or export feeds.

Any data about final users should be available and controlled via consentement mgt ui