The firm unveiled a timeline for new privacy rules that will limit third-party access to user data.