Legislation is typically a very suboptimal solution. Even something like GDPR, which is well-intentioned significantly increases barrier-to-entry for small competitors.