I think you are underestimating the complexity of this task by about three orders of magnitude. This is the way to do it, but you can't do it for a company of this scale with a handful of people.
No such law exists for Facebook, so they don't care. Someone needs to pass a law with a big fine attached and then things will change.