Requires a commercial web site that collects personally identifiable information to post a privacy policy.