A response from Europe - I take your legal eagle's comments on US law with interest - here in the EU and in the UK it would be in breach of the Data Protection Act (they've actively used a method which could make personally identifiable data insecure) and under both the DPA and the recent EU law on Cookies they'd have to openly gain your permission first - have you checked images from EU servers to see if the watermarks are on those?