That's very true. The content they're collecting in their databases (e.g., what URLs were accessed by person X) would be the actual data. The metadata is data about that data, e.g., who authorized its collection, or what other agencies it was shared with, or the schema that describes the database fields.

https://en.wikipedia.org/wiki/Metadata