A new California law that recently took effect will prohibit education-technology firms from using student data to target advertising. More than 20 states already have student-data privacy laws on the books, but some security experts say California's law is stronger because it places responsibility on industry instead of parents and schools.