Some software applications are developed to collect, store, and manage users' personal, medical, or financial information. In the United States, such applications are required to preserve users' privacy and to be compliant with the federal privacy laws and regulations. To formally guarantee compliance with federal regulations, it is necessary to express the privacy rules enforced by those regulations in a standard policy specification language. In this work we evaluate the eXtensible Access Control Model Language (XACML) as a formal specification language for privacy laws and regulations. Furthermore, we evaluate XACML features and attributes to extend it in order to enforce those privacy rules.