Congress has warned Mark Zuckerberg, the Facebook Inc. chief executive, that the era of self-regulation for social media is likely over, following Facebook’s data breach and Russia’s use of the social-media behemoth in its disinformation campaign during the 2016 presidential election. Zuckerberg agreed regulation is inevitable, even desirable. But how far it should go — and the implications for his company’s $55 billion in projected revenue this year — are far from settled. Here’s a rundown of what’s being considered.

Improve Privacy Protections for Social Media Users

The personal data of up to 87 million Facebook users, mostly in the U.S., was obtained by Cambridge Analytica, a British consulting firm that, among its other work, helped elect President Donald Trump. Some lawmakers and privacy experts are calling for more consumer protections, as they’ve done many times in the past after data leaks. Such legislation has gone nowhere in Congress, so what’s different this time?

For one thing, tougher rules for companies that collect and use consumer data go into effect in the European Union next month and the Facebooks, Googles and Twitters of the world are already figuring out how to comply. The General Data Protection Regulation sets new standards for any holder of sensitive data, from Amazon to local government councils. They must post clear terms and conditions for users and get “unambiguous” consent. Opting out of data collection should be as easy as opting in. Consumers must get free access to what’s been collected and how it’s being used; data will be destroyed when no longer needed. Consumers also get to have some information erased under a “right to be forgotten.” Fines for the most serious violations can go as high as $24.7 million (20 million euros) or 4 percent of annual revenue.

The U.S. has avoided these types of laws, but those days may be numbered. “Your user agreement sucks,” Senator John Kennedy, a Republican from Louisiana, told Zuckerberg during an April hearing. The purpose of the agreement is to cover Facebook’s “rear end,” not to defend privacy rights, he said. “I don’t want to have to vote to regulate Facebook, but by God I will.”

Enacting sweeping new privacy laws in the U.S. is a tall order. Many members of Congress, though they might not like Facebook, are still skeptical of regulation. The legislature is controlled by Republicans, many of whom oppose the government telling companies how to run their businesses. “Whenever a controversy like this arises, there’s always the danger that Congress’s response will be to step in and overregulate,” Senator Orrin Hatch, a Utah Republican, said at the first of two congressional hearings featuring Zuckerberg in April.

Digital Protection Agency

A few members of Congress raised the idea of starting a whole new agency to police how Americans’ data is shared online. A “Digital Protection Agency” would have the power to penalize companies for data breaches and set rules for what data corporations can collect and how they can use it. When Representative Raul Ruiz, a Democrat from California, broached the idea with Zuckerberg, the CEO said the idea “deserves a lot of consideration,” but he also wanted to give more thought to the details.

Regulate Digital Ads

Facebook and Twitter have come out in support of the Honest Ads Act, a transparency measure co-sponsored by two Democratic senators, Amy Klobuchar and Mark Warner, and Republican John McCain. The bill would bring disclosure requirements to online political ads, like those required now for such ads on TV and radio. The idea is to let voters know who is trying to influence them. Critics say the measure addresses only part of the problem, since groups can offer names that give little hint to who’s actually behind an ad.

Already Facebook has announced changes to its advertising policies that it says will make it harder for rogue operatives to push divisive points of view. Advertisers touting social or political issues will need to verify their identity and location.

The legislation and Facebook’s action aim to help prevent a repeat of 2016, when Russian operatives used ads and bogus accounts in a bid to shape voter opinion. Facebook turned over to Congress more than 3,000 ads purchased by Russian parties that reached 10 million users during the presidential race.

Separately, the Federal Election Commission is moving toward requiring online political ads to show details of sponsorship — a proposal that even commission members characterize as a narrow reform.

Meanwhile, Maryland is poised to be the first state in the country to regulate political ads on Facebook and other social media sites with a law that would require them to quickly post public information about who bought the advertisements, whom they benefit and how much was spent. Illinois has the only law in the country that offers users the right to legal action when a company fails to protect their data, including the likeness of their eyes, fingers or face. The unique law is being invoked in a lawsuit against Facebook that aims to collect as much as $5,000 from the social media giant for each instance in which a user’s image has been used without consent.

Regulate Digital Content by Holding Websites Liable

Trump on April 11 signed a bill to combat online sex trafficking that opens websites to liability if they knowingly facilitate such crimes. The bill is supported by Facebook and the Internet Association, a trade group that counts Facebook, Alphabet Inc.’s Google and Twitter Inc. as members. But several tech companies and trade groups are concerned that the law would harm innovation by opening large websites to legal sanctions caused by bad actors.

The measure isn’t just about sex trafficking. It’s the first step toward holding internet companies responsible for their websites’ content. It could also be a harbinger of efforts to control other illegal activity online, such as the drug trade.

Limit Their Size

Some lawmakers have started to talk about reining in the size of the tech Goliaths. The 20-year dry spell in U.S. monopoly cases has led economists and even some tech experts to conclude that enforcement has been too timid, with negative economic effects. Facebook and Google control more than half of U.S. internet mobile ad spending. Facebook’s share of mobile social-media traffic, including its WhatsApp, Messenger and Instagram units, is about 75 percent, by one estimate. South Carolina Senator Lindsey Graham, a Republican, pressed Zuckerberg during the April hearing about whether his company has any competitors. “You don’t think that you have a monopoly?” Graham said. “It certainly doesn’t feel that way to me,” Zuckerberg responded.

Tech giants argue that their dominance is hardly durable because barriers to entry are low for new competitors. Google is fond of saying competition is just “one click away.” The companies also say they are successful because of the quality of their offerings, so why punish success?

The last big tech case was in 1998, when the Justice Department successfully challenged Microsoft Corp.’s dominance of computer operating systems but lost on appeal and eventually settled.

Enforce Existing Agreements

The Federal Trade Commission is investigating whether Facebook breached a 2011 consent agreement to safeguard users’ personal information and former FTC officials say that the Cambridge Analytica scandal appears to violate that settlement. The agency could fine Facebook up to $40,000 per violation per day — which could add up quickly with millions of users involved. Under the settlement, Facebook agreed to get consent from users before sharing their data with third parties. It also required Facebook to establish a “comprehensive privacy program,” block access to a user’s account within 30 days of it being deleted and barred it from making any deceptive claims about its privacy practices. Facebook says it didn’t violate the consent agreement.

Reference Shelf

QuickTake explainers on the Facebook-Cambridge Analytica data breach and the European Union’s coming privacy-protection rules. More QuickTake explainers on whether Facebook and Google are too big and should be broken up, addictive apps and the global backlash against big tech. A Bloomberg Intelligence analyst writes that antitrust is a bigger threat to Facebook and Google than EU privacy rules. A Bloomberg News article summarizes the big takeaways from Facebook CEO Mark Zuckerberg’s April 10 Senate testimony. A Bloomberg Government transcript of the April 10 hearing. A New York Times op-ed on regulating the big five tech companies as monopolies. What Bloomberg reporters gleaned from Zuckerberg’s notes left open at the Senate hearing.