“The alarm is a fair reaction,” one privacy lawyer said.