Self-Regulation and Privacy Online: A Report to Congress