Regardless of industry, all companies that collect consumer data must comply with the privacy and security commitments made to their customers in their privacy policies/notices or face potential regulatory action from agencies such as the Federal Trade Commission.