I believe that legislation got us into the Facebook problem in the first place. If you disagree, please take the time to correct me instead of downvoting my opinion out of existence. I'm open to a change of mind. Here's how I see it:
All of these social media companies have one thing in common: they exist to sell ads. We don't really know what Facebook would have looked like as a subscription service, because it wouldn't have ever become dominant.
For ads to work best, they have to be targeted at users. This incentivizes data collection that helps with ad targeting, which is pretty much everything.
But for ads to work at all, the user has to actually see the ad. This incentivizes engagement, because you need attention on your ad for the ad to have value. If you need engagement, you have to find a way to reach users. This is quite good if your business is selling ads, as you already have all of the data. And so the cycle of collecting and using data for acquisition goes on forever.
Since the very beginning of the ad business, companies like DoubleClick (later acquired by Google) have stretched the limits of web technology to make all of this work. Pixel bugs, cookies, app SDKs, all kinds of tricks, anything they can do to get more data about the user, because that's the gas that makes the whole engine run.
Users, however, are prevented by government regulation from stretching the limits of technology to fight back against these companies.
Have you ever wondered why there isn't a large market for paid alternative Twitter clients that cut out ads and data collection? There used to be, back when Twitter had a very permissive view of their data. Then Twitter changed the rules and now it's a grey area if using their private API with an app-extracted key is a crime or not. It's certainly not something you can build a company on.
So the situation here is that social media companies rely on you not being able to "hack" because there are legal protections on how you can interface with their public-facing internet servers and what you can do with the data that those servers send in reply. Because of legislation like the DMCA, paid for by media companies, users never even got the chance to fight on the same technical battleground where they were already being exploited by ad companies.
As I see it, these companies are using public infrastructure when it suits them. If a computer client is allowing third-party cookies, well, that's just downright reasonable to use for ad tracking. But if you alter a query string, you might be a criminal. That's where regulation has got us.
If Facebook is to be regulated, you can be sure that they'll write the regulation.
My litmus test for if there's a free market situation here: Are you free to make an alternative ad-free Facebook client that uses private APIs extracted from the real Facebook app? Because if the answer to that is no, as it has been since these companies have existed, then no amount of regulation is going to improve the situation.
User rights and privacy is a fight we could win technically without some very specific computer and copyright laws. We need to get back to the idea of the internet being public infrastructure.
If there was some change to the law that suddenly let people build better Facebook clients without fear of being sued into oblivion or even arrested, then I think we could finally get these companies under control.