Rigid federal mandates hinder privacy technologies