If the start-up is to monetize due to lack of privacy laws, then this regulation is specifically meant to prevent such companies.
If they are the middle man with no dependence on private information, then yes it will cost them to be compliant but it won't break their business model.
If they are the middle man with no dependence on private information, then yes it will cost them to be compliant but it won't break their business model.