On Monday, Pandora announced, via an SEC filing, that they received a subpoena for a federal grand jury. That grand jury will investigate whether Pandora and others are distributing customer information without proper disclosure. That kind of abuse could bring criminal charges, in violation of the Computer Fraud and Abuse Act.
While criminal charges are an option, they are unlikely. Experts say that the companies found in violation will most likely incur civil suits, or be required to make monetary payments. The real goal appears to be to encourage more respect for users' privacy.
source: Wall Street Journal via Gearlog