What we need is a Sarbanes-Oxley for the Internet. If you track users and store their data, you have to be Internet-SOX compliant to prove you're handling it in a responsible way. Especially with the anti-fraud protections on credit cards these days, storing PII and browsing history is a lot more dangerous than a credit card breach.