Maybe they shouldn't need to, but they do. Due to regulatory capture and deregulation (at least in the US), the law provides very little protection against scumbag companies.