They can't, but if you make CA mad and they decide to sue you, you'll be out much more than it would've cost to just copy and paste a boilerplate privacy policy. A great deal of legal mechanics work this way -- sure, someone can't
technically make that kind of mandate, but since it costs a lot of money and time to have a court case where that kind of thing gets proven, you're better off just making sure no one even tries.
Pretty much any civil action is similar. Unless it's on a massive scale, ask a lawyer what you should do when someone appears intent on pushing a frivolous copyright suit on you. Sure, you have every right to use that content, but do you have the tens of thousands of dollars (minimum) and months or years in court to prove it? It's practically always easier to just accept that you've been bullied out of exercising your rights and replace the contested content with something that the claimant won't launch a frivolous suit over. Lawsuits are only worthwhile when the workaround is more expensive, which is often a hard standard to meet -- that's why most cases end in settlement.