California's student data privacy laws have loopholes that allow tech companies to sell personal information. A new bill aims to close these gaps.