Legislation would have FTC assign companies “privacy scores”