You're exactly right. A quick glance at the actual FTC regulations show that it applies to financial institutions and creditors -- in other words, banks and credit card companies.

And it's not some mysterious "Do Not Sell" list. It just requires those companies to create and implement a plan to prevent, detect and mitigate identity theft. Which is something they *should* all be doing anyway.

Talk about a distorted summary of what this really is. Not to mention that the FTC regs were issued in October of last year, so it's not really new either.