Depending on the regulation, IMO a sensible middle ground is to phase in regulations based on company size as measured by revenue and/or employee count.
This avoids crushing upstarts while regulating companies large enough to matter.
This avoids crushing upstarts while regulating companies large enough to matter.
What you're really just creating here is an economy for small companies to steal and datamine your data and then resell it to others.
For all the constant grinding about FB/Google on this website, small startups are usually a significantly larger privacy catastrophe with little morals and very little security. Most of them don't even consider privacy and security as something to be thought of while they're throwing out their MVP.
This might have other metrics though -- sources / sellers, for a market or middleman entity, some weighted metric of business customers for b2b suppliers (such that an F-10 company weighs more than an F-10000 company). For physical management (say, commodities), total tonage moved. Et cetera.
E.g. could Facebook run with 20 staff? Would Facebook and its shareholders be satisfied with 20m in annual revenue.
This scenario requires trade offs. My opinion is that monopoly, political and market dominance is a sub-optimal outcome
It could similarly avoid large profits but avoiding large revenues works be trickier. But I'm not an expert in these things, so maybe it's possible if you really know what you're doing.
There are multiple private multi billion dollar companies and I wouldn't be surprised, if they all have less than 100 shareholders.
All of the major tech companies are publicly traded.
Being publicly traded is also a major risk factor for hostile corporate behavior, because the top executives of private companies tend to be the owners and care more about the long-term than short-term profits, so it even makes sense as an explicit policy choice to regulate publicly traded companies more than private ones.