Tim Cook is done with being polite about ad-tracking. At a privacy conference in Brussels this morning, Cook gave a fiery speech denouncing the current state of data collection and targeted misinformation, drawing on aspects of Google’s ad-targeting system and Facebook’s social profile-building practices. For Cook, that system of data collection, collation, and targeting amounts to a “data-industrial complex,” which threatens both privacy and democracy itself.

“This crisis is real,” the Apple CEO said. “It is not imagined, or exaggerated, or crazy.”

In what has become the most noted portion of the speech, Cook threw his support behind a new federal privacy law in the US, casting it as a necessary step in countering the growing torrents of data. “We at Apple are in full support of a comprehensive federal privacy law in the United States,” Cook said, emphasizing that any such law should include rights to data minimization, disclosure, security, and user access — all provisions that are present in Europe’s GDPR.

But while the moment made headlines, Cook’s stance isn’t as bold as it seems. As the tech backlash has grown, nearly every tech company has endorsed some kind of federal privacy bill, often in direct testimony to Congress. Facebook’s Mark Zuckerberg and Sheryl Sandberg treat regulation as a given, telling Congress the only question is how such a bill should be written. Google even went so far as laying out what a responsible data-privacy bill might look like, in advance of a Senate Commerce hearing in September. Microsoft has drawn less attention as a regulatory target, but CEO Satya Nadella has spoken in similar terms, endorsing the GDPR as “a good, sound regulation.”

Tech companies haven’t always been so blasé about new privacy laws — but at this point, regulations are coming whether they like it or not. If they want a say in how the rules are written, their best option is to get on board. That lets them steer the conversation toward a weaker version of the bill, much like the one put forward by Google. And with the GDPR already in place in Europe, the most serious damage has already been done.

If Cook’s speech this morning was more full-throated than what you’d hear from Mark Zuckerberg or Sundar Pichai, it’s because Apple isn’t in the targeted advertising business (or at least not mostly).

As a hardware company, Apple’s not as worried about provisions on opt-in consent and web tracking — but that doesn’t mean the company has nothing to lose in this fight. The GDPR required Apple to roll out a new account shutdown procedure, and future regulations could force even more painful regulations. The new iPhone is a handheld facial-recognition device and the Apple Watch collects lots of personal health and medical data, even if none of that data reaches Apple servers. The privacy practices for both systems are strong, but it’s easy to imagine a new law messing them up if it’s written too broadly. And more than any of its competitors, Apple is deeply committed to doing business in China, which brings its own privacy issues. Congress’s current crop of draft bills don’t do much to threaten any of that, but that could easily change. Making fiery speeches to regulators about ad-targeting is a way of making sure it doesn’t.

None of this should detract from the work Apple has already done on privacy, which is significant. By tightening Safari defaults, the company has pushed back against web-tracking in real and powerful ways. Apple’s device security is still the best in the business, and it’s the biggest reason all of that personal health data tends to stay secure. Cook isn’t the first to warn about the dangers of ad-targeting, and it’s a warning we should take seriously. But Apple is still a tech company. Its products are still caught up in the web of logging and targeting that Cook describes, whether it’s the apps that make the phones so essential or the search revenue flowing in through Safari. When it comes to data collection, Apple has a lot more in common with Google and Facebook than he’d like to admit.