The online advertising trade group IAB Europe is making changes to how it suggests publishers and ad-tech companies comply with Europe’s data privacy laws, but some say the updates might not properly protect user data—or protect companies from regulatory scrutiny.