Same goes for any "regulation" in the states. Gov't does their job only when it brings revenue in the $$$$$$ territory. Everything else is civil and ignored - even if it's promoting the sale of millions of protected information.

Of all the reports I've submitted (evidence included) followups and fines have been issued to exactly 0 companies. Hell, Quadlock [phone mount company] happily acknowledged that their policy is to verify identity by requesting plain emails including photocopies of the credit card used for purchase and full state ID. Absolutely against regs.. who cares? Not the SCC nor the FTC.