New data on privacy policies shows 20 percent of sites may sell data