Insight on whether this would/should/must/wouldn't be in a privacy policy or TOS would be appreciated. Also, known (common) instances of where this is known to

Insight on whether this would/should/must/wouldn't be in a privacy policy or TOS would be appreciated. Also, known (common) instances of where this is known to occur would be too. Really, any insight or discussion on the topic would be helpful.