Visitors are required to wear a life jacket or wetsuit, you cannot feed the fish or submerge yourself beneath them, only three people (plus a guide) are allowed in the water at one time, and, no, you cannot catch a ride on their fin.
BBC: Swimming with whale sharks in Mexico