A new law will ban retailers from using shoppers’ personal data to hike grocery prices—but consumer advocates warn it contains loopholes that companies could exploit.