Maybe that's true in say the US, or some states in the US, but it isn't true everywhere. The EU is probably the biggest counterexample, with relatively strong p

Maybe that's true in say the US, or some states in the US, but it isn't true everywhere. The EU is probably the biggest counterexample, with relatively strong privacy and data protection rules already, and almost draconian new rules for organisations that are working with personal data coming into effect later this year with the GDPR. A privacy policy is a part of the rules there, and misleading with one could get you in trouble with the regulators if someone complained.