regulatory lag, technical complexity, jurisdictional boundaries, the inability to mandate values, and the persistence of structural power. - **Self-regulation** has a poor track record in data protection but can be effective with aligned incentives, credible regulatory backstops, independent verific