Bill would put mobile app vendors on the hook for privacy