The Privacy Merchants: What is to be Done?