I was part of the FASTF deliberations back in 2005-2006. I consulted when they brought it in, and I have watched industry follow it. It has surprised me that some of the companies seem to be going a little overboard with compliance.
I have to think that various people are making more of it than they need to, perhaps because it's legislation rather than best practices. I don't see this as being any different from basic industry practices. We can see that the EU has regulations almost as strong as ours, as does Australia, and the European ones are about to get a lot stricter. We have to consider where things are going elsewhere. It has always struck me that people have gone overboard.
Currently, when I give my email address to a Canadian entity, I know it's not going to get sold. This has changed. It used to be that they just it spread all over the place, and there was no way of controlling it. It is much better now than it used to be.