Regulation must focus on business models, not technology