This article explores the developing phenomenon of the ongoing collection and dissemination of personal identifying information (PII): first, explaining the nature and form of PII, including the consequences of its collection; second, exploring one of the greatest threats associated with data collection—unauthorized disclosure due to data breaches, including an overview of state and federal legislative reactions to the threats of data breaches and identity theft; third, discussing common law and constitutional privacy protections regarding the collection of personal information, revealing that United States privacy laws provide very little protection to individuals; and fourth, examining current practices by online commercial enterprises regarding privacy policy disclosure and conduct. This section reveals that there is almost no legal regulation of online privacy policies. This paper concludes that new, stronger laws are required to protect individuals regarding the collection and dissemination of their PII. A model law is therefore proposed to address those areas where PII protection is lacking.