Some regulatory requirements are manageable by a large, established company but not a startup. For instance, requiring human review of user content is going to be tough in a high growth phase.
For example if I log into the Facebook business manager for a company I can see tons of data on Americans but not nearly as many details for Canadians, it's because of these laws. The new E.U. laws are even stricter with regards to personal data and how it's used, no matter who you are.
Why there is no demand for this level of protection in the States by its citizens and representatives is crazy.
Anyone who expects goodwill from Facebook, Google or any company is seriously misguided. Privacy laws need to be in place, actual laws that are bound my the federal legal system, and not just state regulations.
The U.S. is culturally much more opposed to government interference in citizens' interactions, compared to Europe. The U.S. started as a rebellion against an authoritarian government.
I suspect this is because a lot of the first Europeans who migrated to North America were the self-reliant type who actually would flourish best if left alone. What we see as help or protection, they see as interference. (This doesn't explain Canada. Inexplicability is one of Canada's many charms.)
You may not believe that if you live in Myanmar or Kenya. Large amounts of behavioral information in the hands of the wrong people can absolutely be a life or death issue.
Smaller organizations would have a much harder time complying with legal changes that significantly erode the Safe Harbor provisions of the DMCA that make platforms not responsible for the actions of their users.
Not only that, laws have a tendency to set a particular model in stone.
The model large companies use is to collect everything they possibly can and then use bureaucratic processes to control access.
The model small companies and individuals use is to minimize the data they collect and use technical means to ensure that the company has no access to the customer's data at all. This obviously tends to be more secure.
But if the bureaucratic process is required by law regardless of whether it's really protecting anything, the more secure model becomes impossible -- you have to collect all the data because it's the only way to make enough money to pay for the bureaucratic overhead.
There have been a zillion startups that have had collecting user data baked into their business model.
And they can rot like Facebook. Nobody is trying to save them. The problem is you're destroying anyone whose model isn't that.