There's some good commentary here about policy and regulation, and a sort of blind spot regarding new laws. The gist of it is Facebook did a bad thing, surely that's illegal, so let's punish them via big fines, etc. But we're not going to write a new law to forbid the bad stuff because that would be to admit it wasn't illegal the first time. In a way, we handicap our efforts to criminalize bad behavior because we can't stand the idea that bad people might get a free pass. And so, Facebook gets to negotiate its punishment because if it's too heavy, they'll go to court and argue the bad stuff was never illegal. Spoiler alert: nobody wins, but everybody gets to put out a press release declaring their satisfaction resolving the matter.

https://www.bloomberg.com/opinion/articles/2019-07-23/facebook-negotiated-its-rules