Rules Roulette
Photograph: Robert CardinBecause no comprehensive national privacy laws exist, figuring out what a business (or government) can do with your data depends on your state, the industry, and the type of information involved. "One company could be covered by seven or eight different types of privacy laws," says the CDT's Schwartz.
Advocates have pushed for a national standard for years, but acknowledge that we're nowhere near getting one.
Consider something as private as what you watch on television. Cable companies are governed by specific laws that spell out what they can and can't do with the details of your viewing habits; for instance, they are generally prohibited from sharing your information with third parties. But digital video recorders like TiVo fall outside those laws, says Schwartz.
"TiVo has a pretty strong privacy policy for what they do with the information" they collect, and the company is bound by it, he says. But coming up with that policy was a business decision, not a legal mandate, and the company could choose to change its policy at any time.
"The consumer dilemma is, similar products or services can have very different privacy implications," says Chris Hoofnagle, West Coast office director for the Electronic Privacy Information Center, a privacy advocacy group. Users shouldn't be expected to know that, he says, "but they are."
Ad Choices