let's oversimplify this, shall we?
If the company is confident to not be selling data, then there is nothing to verify. The fact does not exist in the first place, so there is no reason to spend weeks to "talk to legal dep"
If the company does need to talk to legal, then there is something they have to verify, and this means they are not confident to be able to claim they NOT sell the data.
Basically, their delay already answered the question.