. . " practice by claiming in its privacy policy that it only collected information such as the user's IP address, operating system, browser type and site activity." . . . .