> In that case, think of a rapidly growing startup, which breaches that mark (50% or whatever the law says) - and now has to comply with the law.

> But the startup is not capable of compliance, because the law was made for behemoths like google.

If I were 'king of the world' I would consider something like this, but would not have it be a binary 'must comply or exempt' but a spectrum of ranges from 'totally exempt' to 'totally regulated' depending on what percentage of 50% you had.

If you have 5% of user emails, you are responsible for the bottom 10% of regulations and/or you need to fully comply with the regulations for a sample size of 10% of your users.

IDK I need to give it more thought, but first, another zoom meeting awaits.

That doesn't sound very realistic to me. A startup doesn't just capture 50% of any significant market over night. It will have plenty of time to hire some compliance staff as it grows.

Regulation and civil lawsuits don't serve the same purpose. Regulation is making the rules. Courts interpret the rules in light of a specific situation.

I agree that regulation can be counter productive. It can create a level playing field or cement dominant positions of encumbants. So let's have good regulation.

Are startups that have collected data on 50% (or even 10%) of the US population still small enough that complying would be burdensome?

The answer here depends a lot on what the hypothetical regulation would be.

Does anyone know how many consumer oriented startups reach 30 million customers?

Thanks for your comment. I need to think about your other points, but what if we changed "data" to "behavioral data?"