Can a company lie in their privacy policy?

Maybe I'm just not very well versed in this sort of thing but I couldn't find anything online. I've always been sort of paranoid that a company might not be truthful in their privacy policy. Is there any sort of law to keep them honest or do we just have to take their word on it?