It's not that big a burden - just have an officer and don't collect certain types of data without the user's consent. If you can't do that minimal amount of effort and either ensure the user's privacy, or get the user's consent, then you shouldn't be in the business.

It's like complaining about how new credit card businesses or banks can't just start up but need a load of compliancy. That was tried with cryptocurrencies and billions of user's monies was lost due to poor security and scummy companies.