Here's an interesting suggested solution to the RFID privacy concerns: give consumers the ability to disable or mask output from RFID tags on consumer goods at home.

That way consumers will have the ability to protect their own privacy, without having to depend on legal regulations.

That's the premise of this very interesting research paper and this PowerPoint presentation:

"In this paper, we present a model of the lifecycle of RFID tags used in the retail sector and identify the different actors who may interact with a tag. The lifecycle model is analysed in order to identify potential threats to the privacy of consumers and define a threat model. We suggest that the in-store problem is more related to lack of privacy solutions for the consumer himself than for the RFID. We propose a solution to the RFID privacy problem, which through zero-knowledge protocols and consumer control of keys has the potential to ensure consumer privacy needs without reducing corporate value from utilising the potential of RFID. We propose that securing RFIDs will require a physical redesign of RFIDs but that this can be done without leaving security and privacy issues to consent or regulation."

The paper actually outlines methods for "masking" tags, so to speak. I can't comment on whether the methods will work or how practical they may be.

[Hat tip to the RFID Tribe discussion group.]