Introduce general data protection rules, then forbid data transfers to countries that cannot guarantee protection of users' data. That what's happening in the EU with US-based software.

Require servers to be hosted domestically. This doesn't prevent exfiltration, but it can be more closely regulated and inspected.

Many countries ask this of US companies, so there's no reason we shouldn't adopt a similar stance.

You can’t. But you can ban apps that don’t comply to these laws. Similarly to how China band google and Facebook for not complying with their laws.