All companies have to do is abide the local rules set by regulations, if such exist. And some very much do. Maybe not in your jurisdiction?
I think you two have things backwards
The point being that there are not enough regulations.
One feature that I wish exist is the option to completely erase your account on a particular website along with the data they have collected from you (there can a waiting time of few months before they erase it from their servers). This feature can only be bought out by government regulation because most websites don't have the incentive.