Is this something they can confidently define in a privacy policy? This feels like its proper scope would be legislation. Indeed, legislation which is very much

Is this something they can confidently define in a privacy policy? This feels like its proper scope would be legislation. Indeed, legislation which is very much unsettled and ongoing. My assumption is they'll do as much as the law allows, but if the law doesn't allow it, their privacy policy isn't going to make a difference.