Unfortunately, as with any law that says they're going to give companies a big fine or punish execs personally, they don't even *really* need to enforce it. The very threat of possible enforcement will be enough to make websites self police.