Companies will be banned from collecting and selling their users’ personal data under the new law.