THE FEDERAL Trade Commission may soon levy on Facebook what many observers are calling a “massive” fine — though massive looks a lot smaller next to a company that is itself a colossus. But as important as disincentives against behaving badly are the incentives Congress must craft for companies to behave well.

The maximum penalty the FTC has issued against a privacy violator so far is $22.5 million on Google in 2012. That company took in $136 billion last year. Facebook took in $55.8 billion. Fines of the scale the FTC is accustomed to, in other words, amount to little more than a bee sting on a tech titan’s shoulder. Under pressure from critics to prove their gumption, regulators have reportedly discussed imposing a multibillion-dollar penalty on Facebook this time around, for its violation of an eight-year-old legal agreement to better protect user data. Still, advocates want more from government enforcement, from higher fines to authority for state officials to the jailing of executives.

The rationale for drastic action tends dangerously close to punishment for punishment’s sake: Americans are mad at these companies, so it is time to make the companies pay. Yet the proper goal of steep penalties should not be to cripple the nation’s technological innovators; it should be to encourage them to innovate in a manner that benefits everyday Americans as much as it benefits the firms. Enforcement is worth little until lawmakers figure out what exactly they are trying to enforce.

The most powerful firms right now compete to make their ads more attractive by amassing virtually unlimited stores of information about users from every corner of the Internet. They sell their ability to know where users are and serve them targeted advertisements that follow them where they go next. As long as this model persists, consumers will be at risk of excessive monitoring and data misuse. But consumers could also lose if these sites switch to subscription strategies: The offerings of Silicon Valley superstars should widen the world and Web for everyone, not just for those who can afford it.

Advertising isn’t going anywhere. But smart privacy rules can make it healthier. Companies should be competing not to know as much about users as possible, but to build the best product for users as possible — selling their ability to attract more people to spend more time on their platforms and see more advertisements. Facebook and others could still tailor those ads by harnessing the data they collect on their own sites, within limits, rather than by trawling the Web for infinite information. They could also do things the old-fashioned way, by promoting relevant products in relevant places.

There’s plenty of room for argument about the best way for Congress to make this happen, just as there is plenty of room for argument over the proper penalties to impose when companies do not listen. But the first step lawmakers must take is the same one many of these companies took when they started out: They must determine what kind of world they are trying to create.

Read more: