Amid its huge data scandal, Facebook’s execs seem to be welcoming new rules to govern how the company operates—but it will be hard to agree on what they should look like.

Asking for it: On Wednesday, Mark Zuckerberg told CNN, “I’m not sure we shouldn’t be regulated.” Yesterday, COO Sheryl Sandberg said to CNBC that “Mark has said it’s not a question of if regulation; it’s a question of what type.” But it is a tough question.

Lots to choose: As Wired points out, data regulation varies massively around the world—from outright app bans through highly prescriptive laws (see the EU’s new General Data Protection Regulation) to, well, nothing.

New proposals: Senator Ed Markey of Massachusetts told NPR that there should be a “privacy bill of rights.” Slate says that rules for prompt reporting of data losses would be useful (and adds that, meanwhile, the Federal Trade Commission ought to use more of its muscle).

The FB way: Zuck told Wired that “guidelines are much better than dictating specific processes.” That sounds rather slippery, but he might have a point: laws on tech date quickly and could leave us worse off in the long run, if innovation has to make way for unchanging law.

Bottom line: Regulating Facebook might be necessary—but it won’t be easy.