I dunno, Big Tech keeps having to pay money to Illinois and etc for breaking privacy laws.
But I guess your general point is still accurate; you can repeatedly break laws as long as your privacy policy says so. (no AG is going to put you in jail or something to _physically_ stop you).
