Companies are notoriously reticent to say who they sell customer data to. Hoofnagle and his students sought to collect a list of companies that the top 100 websites sell customer data to. They reached out to the websites and most didn't respond, others declined to share the information and others said they didn't know, he said.

While it might be complicated to put systems in place to govern the flow of personal data, the concept isn't unprecedented, said Jan Whittington, assistant professor at the University of Washington. "We have put in place extravagant systems to protect consumers," she said. For instance, the U.S. has elaborate systems to ensure that clean water flows through taps in people's homes, she said.

While all of the panelists agreed that some reform is necessary to at the very least clarify existing laws, most thought such reforms are likely under the current Congress.

The IDG News Service