This is a different proposal from what you made before. This proposed law would not require users to be paying customers (so apps could still have a free tier). It would just require that sensitive personal information gained from apps not be sold to third parties for profit, as is now required for phone records. The effect would be similar, since the ad-supported business model largely relies on such selling of information. But it would be a narrower restriction, because there are many apps with free tiers that do not use the ad-supported business model.

That said, the obvious way to game this law is the definition of "sensitive information". This was never an issue for phone operators because their users are already their customers; people pay for phone service. So there is no incentive for phone operators to try to monetize whatever sensitive information they could harvest, so for them "sensitive information" basically means "whatever information you collect from phone calls" and there is no pressure to manipulate that definition. But it would be a huge issue for Big Social Media, and I would expect them to work very hard to gerrymander the definition of "sensitive information" so it doesn't really restrict their operations.

If they failed and a law like this got passed, would they then actually do the hard work to make all their users paying customers? I still doubt it, but perhaps somewhat less than for the broader law I took you to be proposing before.