Who Should Be Responsible for Protecting Privacy on the Web?