This article examines how public and private sector institutions in the United States and the European Union have reacted to public demand for increased and improved online privacy protection. We argue that self-regulatory attempts do not adequately protect privacy online and that legislative intervention, as is happening in the European Union, is not only a good idea for the United States, but may be necessary to secure future online exchange of personal information. © 2002 Elsevier Science Ltd. All rights reserved.