Definitely some of #2 going on. A lot of the language surrounding privacy disclosure requirements under the Gramm-Leach-Bliley Act is literally copy-paste from a form that the FTC suggests for compliance with the law.

Just about anyone with a financial account in the US will probably instantly recognize this form:

https://www.ftc.gov/system/files/documents/rules/privacy-con...