Practically it’s not squared because people randomly just ignore you (or even worse, maliciously comply), and tracking down all the people doing those things makes it more like exponential.

Eventually, the effort required to actually manage doing the thing is at least as large/larger than just doing it - ex: every large organization.