Yes - the key issue being is that the product offering is an API used by second-party with assumed permission from first-party; they are not selling that data to a third-party.