Privacy Law's False Promise