All they need to do is impose a three digit fine per affected user and Facebook will immediately feel intense pressure.
Might also be worth trying to force them to display a banner on every page of the site "you're on facebook, you have no privacy here", like those warnings on cigarette boxes. These might not work though, people would just see and ignore them, just like smokers ignore warnings about cigarettes.
I'm not using "fine" very literally. Damages paid to the victims.