[pdonis]

people can't be expected to take a detailed look at every product and service they might use to assess it fully, that would simply be too time consuming, so you set a basic standard for prevention of harm

So basically, you're saying people should trade trust in one third party (the service provider) for trust in another third party (whoever sets and enforces the basic standard). I can understand why people may choose to do this (though in many cases I don't think the second third party is any more reliable than the first), but I don't see it as an improvement. I don't think FB cares about whatever legal standards are in place; to them that's just a cost of doing business. But they do care about losing users.

can you imagine what the likes of Facebook or Exxon or whoever might do without them.

Sure, and I can also imagine people not using FB or Exxon (many people boycotted Exxon for years after the Valdez spill, IIRC). Also, I can turn the question around: can you imagine what those who are trusted to enforce standards of behavior might do once they know the public trusts them and won't question what they do? How good a job did regulators do at enforcing standards of behavior on investment banks?

And before you ask, I do not use FB, precisely because I don't trust them to take care of my data. And it's not just FB; I don't trust Google to take care of my data, which is why I don't use gmail, for example, or any other Google services except search and maps. I don't expect anyone to take care of my data unless I'm paying them, as a customer, to do that--and even then I watch them.

[Tyrannosaurs]

No, that's not what I'm saying. It's not one or the other, these constraints don't prevent the possibility that people may leave if they don't like a service and what it does, they're an additional guard against the very worst potential abuses.

I'm not saying that because company X conforms with the (very light) regulation in place that they're to be trusted, just that I see benefit in having two forms of protection in place.

[pdonis]

You're assuming that there is an actual net benefit to having the second form of protection. I don't think there is. It may seem like a short-term benefit if some regulator actually catches, say, Facebook in the act of misusing people's data; but the long-term effect is that people believe that they can actually trust a company with their data when they're not a paying customer (or even, beyond a certain point, when the are a paying customer). And since the long-term outcome of any regulatory scheme is regulatory capture, sooner or later FB will just be buying the regulations they want, and the so-called protection won't be there any more. Again, I refer you to the economy since 2008.