Sure they expressly said they don't in their Privacy Policy but then the CEO admitted they do in fact, but the T&C allow forced arbitration and no class actions

Sure they expressly said they don't in their Privacy Policy but then the CEO admitted they do in fact, but the T&C allow forced arbitration and no class actions. Unless the government wants to make a statement by pursuing them, there is no recourse except public shaming.