What to know about privacy laws when collecting personal data on shoppers