My understanding is that the first time you are big enough and screw anything up (leak some PII, mess up your privacy policy, etc), the FTC gets involved on beh

My understanding is that the first time you are big enough and screw anything up (leak some PII, mess up your privacy policy, etc), the FTC gets involved on behalf of the citizens, and then you settle with them, the terms of which include ISO-whatever compliant audits for the next few dozen years. So Facebook, Twitter, Google, Dropbox are very likely getting audited yearly. I don't know whether e.g. Pinterest has screwed up yet, so they might not be.