50-State Patchwork of Privacy Laws Could Cost $1 Trillion More Than a Single Federal Law, New ITIF Report Finds

WASHINGTON—A growing patchwork of state privacy laws threatens to impose rising compliance costs on businesses as they are increasingly subject to multiple, duplicative rules not just from their home states but from others, too. The out-of-state costs of 50 such laws could exceed $1 trillion over 10 years, with at least $200 billion of that burden falling on small businesses, according to a new report from the Information Technology and Innovation Foundation (ITIF), the leading think tank for science and technology policy, which recommends Congress pass a federal privacy law to preempt states.

“Poorly designed data privacy laws can impose a substantial toll on the economy through both direct compliance costs and indirect costs from lower productivity and constraints on innovation,” said Daniel Castro, vice president of ITIF and co-author of the report. “When multiple states subject businesses to conflicting privacy laws, they increase these costs that ultimately are passed on to consumers.”

To observe the economic impact of 50 unique state privacy laws, ITIF designed an economic model examining the empirical change in the earnings of a state’s industries due to the passage of state-level privacy laws. As the report explains, this helps illustrate the adverse effects of creating a patchwork of 50 separate state privacy laws instead of a single federal law to regulate the collection and use of consumer data by firms. The report also establishes a restrictiveness score that quantifies the extent to which a state’s privacy laws restrict a given industry.

To put these numbers in perspective, ITIF’s model estimates that the costs associated with California’s privacy law would be approximately $78 billion annually, including $46 billion incurred within the state and $32 billion incurred in other states. This estimate aligns with the official regulatory impact assessment commissioned for the state’s attorney general, which projected that California businesses would incur $55 billion in compliance costs.

Table 1: State-by-state costs of a 50-state patchwork of privacy laws

To avoid all these costs for businesses and confusion for consumers, ITIF urges Congress to pass a comprehensive federal privacy law that provides baseline protections for consumers and simplifies compliance for businesses while also preempting states from passing their own privacy laws.

“Your privacy rights should not change when you cross state lines. Policymakers should move quickly to pass legislation that creates a national data privacy framework,” said Castro. “Consumers need basic data rights, and businesses need lawmakers to streamline regulation, preempt state laws, and minimize the impact on innovation.”

Read the report: itif.org/privacy-patchwork.