U.S. data-protection laws do not reflect the public’s preferences, study reveals