[bredren]

Seems straight forward to write that compliance to certain measures is based on gaap annual revenue.

Though in practice, enforcement of regulations in general is already handled this way.

For example a new startup in the valley doesn’t get a note from the gov because they launched without a privacy policy.

Same in the App Store, a minor app breaking App Store rules doesn’t get knocked out because the downloads are too small to bother.