A probe into private messages and other user data says firms had more access than they requested.