In public discussions of social media governance, corporations such as Google, Facebook, and Twitter are often first and foremost seen as providers of information and as media. However, social media companies’ business models aim to generate income by attracting a large, growing, and active user base and by collecting and monetising personal data. This has generated concerns with respect to hate speech, disinformation, and privacy. Over time, there has been a trend away from industry self-regulation towards a strengthening of national-level and European Union-level regulations, that is, from soft to hard law. Hence, moving beyond general corporate governance codes, governments are imposing more targeted regulations that recognise these firms’ profound societal importance and wide-reaching influence. The chapter reviews these developments, highlighting the tension between companies’ commercial and public rationales, critiques the current industry-specific regulatory framework, and raises potential policy alternatives.