> I thought privacy policies like this were in fact legally binding...
This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear.
But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear.
But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.