Should Facebook be 100% held responsible to the law? Of course.
Should some laws be updated/created to help fill gaps where we might need more privacy? Possibly.
Should Facebook be held to some nebulous moral standard of what some people want but don't have the will power or public support to codify into law? Absolutely not.
Too powerful? If people actually cared more about privacy, then either the law would get changed (which is happening in some places), or Facebook would lose market share and be forced to make changes from market forces alone. No need for governments to arbitrarily pick winners and losers.