Or you just build your permissions and opt-in platform as a base for the social app.

We wouldn't let a self driving startup ignore traffic laws because it's "too hard". Likewise we shouldn't let a social startup ignore privacy laws and auditing.