Would have to read thru Tittle II of the communications act and see what portions they are under. Title I is POTs and Title II is ISPs and Cellphone providers. Title I tends to be much more strict.

Several states have privacy laws limiting or requiring disclosure of how their data is used.

If I understand correctly the FTC only prevents companies from selling your data when they've told you they won't.

Electronic communications privacy act, to start.