An experiment by Consumer Reports suggests companies may not be consistently complying with data privacy laws.