Getting privacy policy right in a competitive digital economy

State and local leaders are working to protect residents’ privacy while keeping their economies competitive, affordable and innovative. 

Those goals often reinforce one another, but some approaches to privacy policy risk undermining competitiveness if they limit how businesses and consumers use everyday digital tools. Getting the balance right matters, especially as more states move forward with their own rules.

Today, more than 20 states have enacted comprehensive consumer data privacy laws. Where laws share common approaches to transparency, consumer choice and responsible data use, businesses can operate with greater certainty while consumers benefit from clearer, consistent privacy protections. 

This is consistent with the research from the Interactive Advertising Bureau showing that many people are willing to share information when companies protect it. Consumers also expect transparency about how their data is used and meaningful choices about sharing it. Taken together, these findings suggest people want both protection and clarity.

Businesses’ use of data to understand customers and serve them better supports much of modern commerce, particularly for small businesses that increasingly reach customers they may never meet in person. 

A national survey of small businesses conducted by TechnoMetrica for the Small Business & Entrepreneurship Council found that online advertising generates an estimated $163 billion in annual savings and efficiencies, helping small firms lower marketing costs, reach new customers and reinvest in growth. For many entrepreneurs, data-driven tools have made modern commerce possible.

But that progress can be undone by inconsistent or outlier privacy rules. As commerce and marketing move online, fragmented privacy rules can undermine the tools small firms now depend on — raising costs, shrinking reach and creating compliance challenges. 

A study by the Information Technology and Innovation Foundation estimates that, without a consistent baseline, different state rules could impose $98 billion to $112 billion in annual compliance costs, exceeding $1 trillion over a decade. As much as $20 billion to $23 billion of that burden would fall on small businesses. Independent reporting shows many small firms already face compliance costs topping $50,000 a year, often more than they spend on hiring.

Take “data minimization” definitions. Maryland’s Online Data Privacy Act illustrates how principles that sound reasonable can create challenges in practice. By tying what is considered “reasonably necessary” to providing or maintaining a product or service requested by the consumer, the law can limit how businesses collect and use information for other common purposes, including advertising, even when consumers might otherwise expect it. 

When routine commercial activity triggers heightened restrictions by default, businesses lose flexibility and communities lose valuable connections between local businesses and the people they serve.

Other states have taken a more balanced approach. Privacy laws in states such as Virginia, Colorado and Connecticut focus on transparency, consumer choice and responsible data practices while allowing businesses to continue using common digital tools to reach and serve customers. Thoughtful privacy rules can strengthen trust online while preserving the tools that make the modern internet useful, affordable and accessible.

Enforcement matters as much as definitions. Fortunately, most states have avoided creating broad private rights of action that would allow individuals to sue businesses directly over alleged violations. One need only look at how plaintiffs’ lawyers in California have used the private right of action in the California Invasion of Privacy Act to file countless lawsuits based on common digital advertising activities. 

Instead, states have wisely placed enforcement in the hands of attorneys general and regulators, allowing officials to focus on serious problems while working with businesses to correct issues and improve compliance. That approach helps protect consumers while avoiding costly litigation that can discourage innovation and growth.

In a global, digital, data-intensive economy, privacy laws will help determine whether small businesses can grow and whether communities see new jobs and opportunities. The good news is that many states have already shown the path forward. By building on the common elements shared across existing laws like clear notice requirements, meaningful consumer choice and reasonable data minimization practices, policymakers can ensure people understand how their information is used and can easily access, delete, or opt in or out of data use when they choose.

Privacy policy that strikes this balance can strengthen consumer trust while preserving the digital tools that help small businesses grow, attract investment and compete in today’s economy.

Brendan Thomas is the executive director of Internet for Growth, a national coalition of small businesses and online creators that champions access to the digital tools Americans need to succeed in the modern economy.