> A Privacy Policy is just words in most jurisdictions. Not for long. At least in EU.

Well, it's already illegal, it just takes time to prosecute enough data processors until others start being afraid of the fines and start ACTUALLY implementing GDPR.