For any online privacy notice to work, it must be designed to serve consumers by being clear, conspicuous, concise and common sense in its approach. It will not do the industry any good to gleefully trumpet an increase in the number of sites posting privacy notices if it turns out that many of such postings are either hard to find, hard to understand, or both. In addition, as technology changes, sites will inevitably be able to glean more information electronically and surreptitiously from consumers. In such a context, merely informing consumers that a site may have already gathered personal information electronically and providing notice about how it intends to use such information is unacceptable. That's like saying burglary is OK as long as the thief leaves behind a note clearly indicating what was stolen and how the thief intends to use the stolen items.
Notice alone is insufficient.
Consumers must have an effective opportunity to grant or deny consent. To be fair, I'm giving a critique of the work of people and companies who are at least trying to be constructive and be part of a solution. Today, our public policy has set up an inverse system of rewards and punishments. If a company takes the time to develop and post a privacy policy and then at some point violates it in some way, the FTC can go after that company and seek to address consumer grievances. On the other hand, if a company posts no policy at all and then engages in personal information hijacking on a daily basis, it is legally free and clear to do just that and continue on its merry way.