That's correct. There is no general privacy law affecting the commercial sector, travel agencies, or airline reservations systems in the U.S. They can use the data for any purpose. They can sell it. They can share it around the world. They don't have to tell you what they're doing and they don't have to get any permission. Once you allow data to be transferred for any reason to anybody in the U.S., you've let the cat out of the bag. It's completely unregulated.
On November 30th, 2010. See this statement in context.