Rich, former director of the FTC’s Bureau of Consumer Protection, says sometimes the disclosure is right there, detailing how your contact information is being used, but people skim over it. She points to an example on the main CVS website: “To the extent permitted by applicable law, we may provide personal information to our affiliated businesses or to our business partners, who may use it to send you marketing and other communications.”