California law regulates web site privacy policies.

If your company operates a commercial Web site or online service that collects personally identifiable information from consumers, a California law that went into effect on July 1 may affect the way that you conduct your business. The California Online Privacy Protection Act requires any operator of a commercial Web site or online service that collects personally identifiable information from California residents through the Internet to conspicuously post its privacy policy online and comply with its posted policy. The broad language of this groundbreaking state law suggests that it may apply to virtually every business that sells products or services online. Although there have been some suggestions of national legislation that might preempt this law, it would be prudent to assume that the California law applies to any Web site or online service that collects personally identifiable information from Californians on or after its effective date of July 1.

…