Thank you for the slap on the wrist. What of the ill-gotten monetary gains this company received from the sale of this ill-gotten private data? What of the private data that is already in the hands of third parties? I see no mention of fines or restitution in the settlement agreement. Surely the company should be deprived of the funds it got from its bad behavior, should it not? Surely the company should be punished with a fine greater than the amount they gained from its bad behavior, should it not? What kind of message are you sending to other companies that might consider this type of data collection? Merely telling them to stop their bad behavior is hardly a win in my book, for either the consumers you claim to represent or for commerce you claim to defend.