Agreeed. And there are several obvious laws without touching 230. Off the top of my head

- Ban businesses engaged in online advertising from compiling real world data / mixing physical world data with the online profiles of users

- Ban businesses engaged in online advertising from building profiles of people who have not opted into their platform; require permanent removal of all data within 30 days of any user leaving their platform

- Require businesses provide human based appeal process to any user or business that spends or earns $1,000 in a year before suspending or terminating an account

These could even be done at the state proposition level, absent state authority