The What, When, and How of Evaluating Vendor Privacy