In congressional testimony earlier this month, Facebook CEO Mark Zuckerberg said he would support regulation of his own company.

Sens. Amy Klobuchar, D-Minn., and John Kennedy, R-La., have now taken him up on the offer, introducing a bill, S. 2728, to impose broad new restrictions on how Facebook and other social media companies can collect and handle  consumer data.

The legislation—dubbed the Social Media Privacy Protection and Consumer Rights Act—was no surprise. Klobuchar and Kennedy had made clear weeks ago that they were planning to propose federal intervention in social media markets.

The goal was to address privacy concerns raised by the acquisition and use of consumer data from Facebook users by Cambridge Analytica data firm.

“We can do it the easy way or the hard way,” Kennedy bluntly statedregarding his regulatory plans, adding, “I do not want to regulate Facebook half to death, but we do have … problems we’ve discovered.”

The bill is a grab bag of mandates and restrictions on how social media networks operate. The most widely discussed provision is a requirement that social media platforms use “plain English” in their user agreements, so consumers can better understand them.

As Kennedy succinctly put it to Zuckerberg: “Your user agreement sucks.”

That line was memorable and garnered quite a bit of attention for the Louisiana lawmaker. But the irony is that Congress is hardly in a position to lecture private companies on plain use of the English language, as anyone who has ever read congressional legislation can attest.

The meat of the bill, however, is not linguistics, but limits on the collection of consumer data by Facebook and other social media platforms.

Among its provisions, the bill would require social media networks by law to disable consumer data tracking and collection (when so requested by a user); to provide notice of a data breach within 72 hours; to delete user data when asked; and to provide copies of what has been collected about them.

The bill avoids the most extreme restrictions that have been proposed. It doesn’t ban use of consumer data, nor does it require an affirmative “opt-in” for such data to be used as a general rule.

But consumers should not celebrate. The Klobuchar-Kennedy plan is likely only the first volley in a probable bidding war over regulating social media networks. Even the mandates in the current bill could threaten the benefits consumers receive from social media platforms.

For instance, by making data more difficult to acquire and to use, advertising revenue may no longer be able to support social media platforms. The end result would likely be a shift to a fee-based system, where users would have to pay to use Facebook and other platforms.

That would be a net loss for most users, who—based upon their usage habits—like the free access to social media made possible by advertising revenue.

So far, Facebook has not made a fuss over the proposed new rules. In fact, it has openly supported some of the provisions, including notifications of breaches within 72 hours and the “plain English” requirement.

But this should create no free pass. Regulations making it more difficult to use consumer data often make competition more difficult, because smaller rivals may find it harder to absorb the regulatory costs.

The impact of regulations varies, of course, based on the specific regulation, but it’s a danger policymakers should always keep in mind.

This doesn’t mean government should do nothing to ensure that an internet-based company such as Facebook complies with its promises to consumers.

If data has been used in violation of commitments made to the users of a platform, the firm should be held accountable for the violation. But that does not necessarily require new regulation.

Robust laws are already on the books addressing breaches of commitments to consumers. Moreover, agencies such as the Federal Trade Commission already have rules that can—and often are—used to enforce privacy commitments.

Consumers can also use state contract law to sue Facebook for any breach of its commitments. No new rules should be imposed without a clear showing that the many existing tools are not already adequate to protect consumer privacy.

This may not be the “easy way” or the “hard way” of making markets work, but it is the right way.