So far, few web sites have met the substance of the self-regulation challenge. Companies and databases change over time. When companies merge, so do their databases. Although it is probably impossible to predict how these companies' databases would be handled in the future, customers would at least have as much information as anyone if they knew what information was being stored about them. Data is persistent.
Data migrates through many systems as it is bought and sold, and as companies merge.
Americans have a right to know what data is being stored about them, so they can be aware of the potential risk of its disclosure in an unpredictable future. Moreover, although companies may not use all of the information they collect today, it is certainly discoverable through a subpoena or court order. Americans should be able to identify which information resulting from private surveillance activities might be used against them at a later date. Absent regulation, companies will have no incentive to bind themselves, because they want the freedom to change their practices. Yet strong, believable representations are critical to consumer confidence in the trustworthiness of privacy policies.