That just means a bunch of fly-by-night startups that have even less controls around data protection than Facebook and Google would proliferate.

i'd suggest making punishments scale with size (and as a result, enforcement), rather than regulations contingent on scale. it's conceptually and regulatorially easier, and more fair.