What you said is incorrect. They do need to follow their privacy policies. It is a legal requirement.

Your comment confuses basic contract legal principles with privacy rules. This isn't a contract matter; it's a matter of public policy.

You can get started learning why here: http://business.ftc.gov/legal-resources/29/35