Big Tech companies’ ecosystems build on the commodification of personal data with harmful consequences for users’ information privacy. The sustained data collection in data ecosystems bases often on secrecy. This opacity creates problems for assessing privacy-violating practices and regulation fails to materialize. Given the challenge of research data access to privacy-violating practices within the ecosystems of companies, we analyzed 21 privacy scandals reported in the media. The scandals include the companies around Facebook and Google, which refined personal data accumulation and utilization practices over years. Our results show that the companies take various roles across service contexts. These diverse roles enable to decouple personal data from the original service context and build the basis for rebounding effects in other service contexts. Using the GDPR in a socio-techno-legal assessment, we indicate that for regulation of Big Tech companies’ practices, the actors’ spheres of influence and the totality of their data processing operations are crucial.