So far, under California’s new privacy law, firms are disclosing too little data — or far too much (Washington Post)