Putting the Consumer Privacy Bill of Rights into Practice