Cyberlaws

Social networking sites are continuously gathering data about users on their sites and selling them to other businesses such as advertisers. Is this ethical? Is this legal? Are current cyberlaws adequately equipped to handle and regulate this practice?