This one is flying under the radar. The Fair and Accurate Credit Transactions Act of 2003 (FACT) imposes significant obligations on most businesses, such as any business that might be notified by a consumer that the consumer has been a victim of identity theft, or any business that prints credit card receipts for its customers. It becomes effective over dates staggered between March 31, 2004, and December 31, 2004.

The Act consists of 61 pages, covering seven separate titles, with detailed implementing regulations contemplated. Under the new law, consumers have significant new rights, such as the right to receive a "risk-based pricing notice" when any user of a credit report extends credit to the consumer on terms less favorable that offered to most customers. Businesses are prohibited from printing any more than the last five digits of credit card or debit card numbers on any receipt provided at the point of sale. AND, significantly, it seems to me, subject to limited exceptions, anyone receiving consumer information from affiliates may not use that information for marketing purposes unless clear and conspicuous disclosure was made that the information would be shared, and the consumer is provided with an opportunity to opt out.

I would guess that only about 99.973696% of online "privacy" policies are failing on that point alone. We should all be hearing more about this one

 http://lcweb2.loc.gov/law/usa/us0412200301pl108-159.pdf 

 http://www.whitehouse.gov/news/releases/2003/12/20031204-3.html