The statute was meant to standardize how companies disclose their consumer data-mining practices. So far, not so much.