it's like there are public laws and hidden "patriot" laws, and companies are not allowed to disclose those things.
as a privacy company, if you haven't yet been raided by some government office, then you are probably compliant on some visible and invisible levels.