It’s not false advertising. Just because a company advertises with privacy, it doesn’t mean they are bullet prove.

they don’t sell your data, they actually have very little data to share at all, but they do follow the swiss law.

They even publish which kind of requests they get: https://proton.me/legal/transparency