In spirit-of-the-law terms (maybe letter of the law too), I'd argue that privacy policy is not a contract. A contract requires a meeting of minds. It's well-known that privacy policies are rarely read and to most people, incomprehensible or unreadable for simple lack of time in the day. That they are binding contracts is a fiction that the legal system just hasn't seen its way through yet.