Two days of congressional testimony by Facebook CEO Mark Zuckerberg proved two things: 1) Congress has a lot to learn about social media. 2) Zuckerberg has been relying on the same set of apologies for more than a decade, and it’s wearing thin.

Facebook developed into what is now a global behemoth with a market value of about $480 billion on an irresistible premise: Connect with anyone, virtually anywhere in the world, for free. Exchange photos, restart old friendships, make new ones, create virtual communities. All in one enticing, friendly, social network.

But all those bits of information, once gathered and cross-referenced with other databases, become an uncomfortably detailed look into individual lives. As Facebook has mushroomed into the world’s largest social network, with 1.4 billion users logging on daily, far too little attention has been paid to how it gathers information, how long it keeps it, who else sees it and how it is used. Facebook has become an unprecedented hybrid that is at once a tech company, a media giant and even a finance company, now that it allows money transfers through its Messenger system.

It’s easy to snicker at the questions posed by some senators on Zuckerberg’s first day of testimony, betraying as they did a distinct lack of knowledge about social media. But that also points up the problem. Controlling one’s personal information should be easy, not hard. It should not require multiple steps, endless rechecking and a computer tech’s in-depth knowledge.

Loose rules and little regulation created the ideal conditions for Cambridge Analytica, the political consulting firm, to gain troves of information about 87 million people through what looked like a harmless little personality quiz. Cambridge, however, is just part of the problem. Users savvy enough to retrieve their Facebook files have been shocked at the granular detail the company retains about them, down to a trip to the hospital, lists of people they’ve “unfollowed,” entire phone contact lists — required to join Messenger using some devices — and so on. Still unknown is the extent to which Facebook tracks users even when they are not actively logged on.

Zuckerberg has acknowledged that his company failed in its responsibility to protect users’ data. But he’s made such admissions before. And when asked point-blank, he would not commit to allowing users to “opt out” of having data collected and made available to others without their express permission. Much of the control he claims users have over their data remains hard to exercise or maddeningly obscure and difficult to access. Zuckerberg and other social media giants have had years to create a better voluntary set of standards.

Europe has tired of the wait and is moving ahead with stricter privacy controls that go into effect in May. Some of Europe’s new rules may not be right for this country, but that shouldn’t stop Congress from getting to work on creating a new American standard for transparency and privacy.