A state can impose restrictions on a social network that has become de-facto a public service. Imposing constraints on a company's use of personal data must be part of the state's public service to protect its citizens.
In the fallout from the Cambridge Analytica scandal, lawmakers in the US from both sides of the aisle aggressively called for Facebook CEO Mark Zuckerberg to testify in front of Congress on the lack of measure to safeguard user data. They pointed out that Facebook had achieved monopoly status and could not be trusted to self-regulate, anymore given the prominence of its use - 68% of US adults use Facebook, and more than two-thirds of that number check Facebook’s website or mobile app every single day.
While there exists a need for heightened regulation, what that regulation ought to look like is unclear with many states taking various approaches. Vermont legislated laws requiring brokers which buy and sell data from third parties to register with the state. In California, a law went into effect in January that would, among other things, give residents the ability to opt-out of having their data sold. 
At a federal level, US Senator Amy Klobuchar has pushed for The Honest Ads Act, legislation that would result in increased transparency behind who pays for political ads online.
Elsewhere in the world the EU has passed the General Data Protection Regulation. Australia's privacy regulator, the Office of the Australian Information Commissioner, has recently announced plans to take Facebook to court for severe breaches of privacy of Australian users.
The varying approaches to social network regulation mentioned above point to existing lapses in regulation policy. Given how profitable user data is, states must make concerted efforts to keep regulate Facebook to protect users' data.