Does this kind of privacy policy they demand follow any law, or it's just their "you should do this way"?