Selling the information of natural persons without permission violates these privacy policies and opens up companies to civil actions, so long as the companies are based in California, Virginia, and Colorado.