>It sure isn’t in the company’s privacy policy

What they are doing is illegal in the state of California.