Re: Google: Do No Evil
This actually seems to be the norm, even for (relatively) small companies. We're conducting research into privacy notice standards, and so far the results are extremely depressing.
Two key points seem to have been missed by all and sundry:
 the GDPR is not data law - it's human rights law
 a privacy notice is not a contract with the data subject - it's a statutory unilateral and binding undertaking by the data controller to the data subject