The National Defense Authorization Act now includes draft language forbidding government entities from buying Americans' search histories, location data, and more.