The correct law is staring them in the face.

Sensitive country is defined by the following list, (xxx,xxx,xxx)

Any company that sells, or gives American data to a sensitive country; or cause their data to come into possession of a sensitive country shall cease operations in the US.

Any company allowing a sensitive country to manipulate their algorithm, examples of (but not exclusively) with targeted advertising, bots, or by manipulating the ranking of posts, shall cease operations in the US.

That achieves the mission and holds the entire industry accountable without unconstitutionally targeting a single company.