@lps You are misunderstanding what I'm saying. Two steps: 1) clearly articulate the rules for everybody 2) Determine who does and does not follow the rules at any point in time. Including but not limited to Meta.

The rules may, for example, state that you must not have been fined by a major regulator for privacy violations in the last N years.

I think this is ultimately a much more productive, and perhaps just, approach than simply banning company X.