The problem is when the regulation doesn’t accomplish anything, but also costs a lot.

For example imagine a hypothetical email safety law that says you must keep everything encrypted and have multiple audits over all of your processes and systems. Such a law doesn’t do anything to protect users, but audits will suddenly result in a massive flat cost to start a new email company.

In reality look at the “privacy” legislation pushed by Facebook and google: mostly it reduces/removed their liability if they do a few relatively cheap things but doesn’t require them to stop spying on you or stealing your data. But relatively cheap for Facebook and google isn’t cheap for anyone else.