US firms make changes in response to EU privacy law