US needs an internet data privacy law, GAO tells Congress – CNET