In your example, service providers may be allowed to collect IP address or cookies or referer which are either critical to how they provide service (IP and cookies) or part of the established norm (browser sending referer).

That doesn’t mean they are allowed to go beyond and scan user’s environment variables