I'll go further - you cannot even put a photo of someone else without their permission, unless it constitutes 'public good' and to be a journalist you have to 'register' - it'd be free and open to do that, but the point being, you're 'on the record' as doing that in some capacity which might come with a few ethical rules.
Sorry for the AI people but we probably want to have rules about data set collection as well.
Absolutely the right to privacy, the right to 'delete' and auto-deletion periods aka 'nothing is kept forever without special consent'.
Absolutely nothing about someone's social media presence can be made public or used for employment searches before age 18 aka that 'bad joke' someone told at age 16 should not ruin their life - I absolutely do not care what they said.
Content that passes a threshold of 'views' must be considered a kind of 'meta public domain' and must come with warnings/notes by the 'conduit entity' (aka FB or Twitter or Spotify) if it has medical or direct political information, aka Joe Rogan (whom I respect at least a bit except when he's yapping about vaccines) has to say 'I am not a doctor, this is not medical information' whenever he opens his fat mouth about vaccines, but he can say whatever he wants about Aliens and MMA etc..
Pricing/sign-ups/trials have to be ultra clear, and current billing has to be clear. Frankly, they should make the intermediary responsible for that as well aka if you have a recurring bill on VISA, then VISA has to list that, and, give you a means to cancel.
Total transparency on tracking, illegal to buy or sell most user data whatsoever. FYI the primary source for this is actually VISA, AMEX and MC.
And work with industry to create 'funnel optimizations' that just don't need tracking.
No advertising directly to kids unless maybe a certain kind of format (I think maybe some youtube ads are ok).