You have a regulatory body to provide outside auditing, high monetary penalties for violations through neglect, and if the violations are intentional, somebody

You have a regulatory body to provide outside auditing, high monetary penalties for violations through neglect, and if the violations are intentional, somebody goes to the pokey. Kind of a codified and structured version of what the FTC does now, except with real teeth and without the problems the FTC faces in enforcement. If you don't like that approach, there are other ways to make the idea work (or, since this is HN, "well actually" it into a fine powder).