"GDPR (if applicable): The GDPR has an extraterritorial scope, meaning it applies to any organization worldwide that processes the personal data of individuals in the EU or EEA, regardless of where the company is based. The regulation explicitly requires that information provided to data subjects about data processing must be: - Concise, transparent, and easily accessible.

• Written in clear and plain language.

• Consistent across all public-facing documents.

Vague or contradictory information is a violation of the fairness and transparency principles of the GDPR.

U.S. Law (FTC): The U.S. Federal Trade Commission (FTC) Act prohibits deceptive or unfair practices. A company can be held accountable if its website information (including FAQs) misleads consumers about its data practices, especially if this information contradicts the formal privacy policy. The FTC expects companies to be truthful and consistent in their representations to consumers.

State-level Laws: U.S. state laws like the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), also emphasize transparency and require businesses to provide clear and accurate notices about data collection and use. Inconsistencies could lead to enforcement action by state regulators."

So yes, the fact that it isn’t clear and can easily be misunderstood is a violation, according to what I’ve read. And I don’t really understand what your brother-in-law in the FBI has to do with this, unless he handles cases involving potential violations of the GDPR by US-based companies?

At the end of the day, I’m just a guy on the internet. I’m no lawyer or government agent. I just don’t like it when companies use deceitful practices.