They in fact cannot even display a message, there is no way AFAIK to distinguish between this situation and someone simply not being logged-in. Even if they could, they would still leave IE users without some functionality. Again, I do not want to be Google's advocate and I do not know their specific use cases, I am just saying they are legitimate use cases for both not having the privacy policy that restrictive (eg. when processing and passing over the users data is actually part of the buisness model) and for doing third party integration, which the security model as implemented by MSIE makes impossible to handle.