I dunno, Big Tech keeps having to pay money to Illinois and etc for breaking privacy laws.
But I guess your general point is still accurate; you can repeatedly break laws as long as your privacy policy says so. (no AG is going to put you in jail or something to _physically_ stop you).
Can confirm. My family has (collectively) cashed about $1,000 in settlement claims.