This certainly is an accurate description of the general situation:

Although providers often provide privacy assurances, these assurances are meaningless. They routinely violate their policies with impunity, at most suffering infrequent regulatory fines that are commercially insignificant, and have legal resources that make civil action by private individuals largely futile, even where civil recourse for privacy harms exists, which it usually does not. Even if the provider itself doesn’t intentionally share this information, they are routinely breached by hackers and leak information, again with general impunity.

Also this:

The whole letter is a very good read. Well worth your time.The whole letter is a very good read. Well worth your time.