That's the truth. It's good to keep an eye on what they'll admit to if nothing else. It'll likely take a whistleblower for people to know what a company actually does with their data, although if we're lucky we might learn something by chance from evidence presented in an unrelated lawsuit. What we really need are meaningful regulations.

This. Also, almost every privacy policy I've ever read has enough holes to drive a convoy of trucks through anyway. I believe privacy policies are worthless, and ignore them.