The new law limits data gathering and bars some algorithmic recommendations.