The elephant in the room: how many of these tactics are used by US companies, considering (I presume) our relatively lax data protection laws?