“Previous bipartisan privacy bills, ADPA and APRA, included a compromise private right of action focused on injunctive and equitable relief rather than monetary damages.”