How one simple rule change could curb online retailers’ snooping on you