"Telling a user ???this site has no privacy policy and so it could do anything with your data, including a, b, and c.??? seems to fall squarely within that mandate." . . . .