[makewavesnotwar]

I think a big issue you're nodding to is localized definitions.

For instance, why must you legally have a privacy policy? Because of a law in California.

What does that privacy policy entail? ¯\_(ツ)_/¯

You can write a privacy policy that say you are going to go out of your way to make any private information given to you as public as you can or sell it all to the king of Saudi-Arabia and if nobody reads that privacy policy then it's kind of meaningless. And very few people read the privacy policy.

People seem to think, well this is popular... so they can't be doing anything bad or someone would stop them. And with internet properties, that's simply not the case.

There's no implicit privacy or federal/global definition of what privacy rights people should have, if anything the rights are diminished the higher up the ladder you get. So people have to navigate a sea of differing definitions in massive legal documents which they aren't properly trained to do unless they already hold a law degree.