ITIF - The Information Technology and Innovation Foundation

01/24/2022 | Press release | Distributed by Public on 01/24/2022 07:57

50-State Patchwork of Privacy Laws Could Cost $1 Trillion More Than a Single Federal Law, New ITIF Report Finds

WASHINGTON-A growing patchwork of state privacy laws threatens to impose rising compliance costs on businesses as they are increasingly subject to multiple, duplicative rules not just from their home states but from others, too. The out-of-state costs of 50 such laws could exceed $1 trillion over 10 years, with at least $200 billion of that burden falling on small businesses, according to a new report from the Information Technology and Innovation Foundation (ITIF), the leading think tank for science and technology policy, which recommends Congress pass a federal privacy law to preempt states.

"Poorly designed data privacy laws can impose a substantial toll on the economy through both direct compliance costs and indirect costs from lower productivity and constraints on innovation," said Daniel Castro, vice president of ITIF and co-author of the report. "When multiple states subject businesses to conflicting privacy laws, they increase these costs that ultimately are passed on to consumers."

To observe the economic impact of 50 unique state privacy laws, ITIF designed an economic model examining the empirical change in the earnings of a state's industries due to the passage of state-level privacy laws. As the report explains, this helps illustrate the adverse effects of creating a patchwork of 50 separate state privacy laws instead of a single federal law to regulate the collection and use of consumer data by firms. The report also establishes a restrictiveness score that quantifies the extent to which a state's privacy laws restrict a given industry.

To put these numbers in perspective, ITIF's model estimates that the costs associated with California's privacy law would be approximately $78 billion annually, including $46 billion incurred within the state and $32 billion incurred in other states. This estimate aligns with the official regulatory impact assessment commissioned for the state's attorney general, which projected that California businesses would incur $55 billion in compliance costs.

Table 1: State-by-state costs of a 50-state patchwork of privacy laws

State

Expected Strictness

Expected Year of Adoption

Total Costs of 50 State Privacy Laws

Costs of Out-of-State Privacy Laws

Costs of In-State Privacy

Total Costs on Small Biz

In-State Costs on Small Biz

Out-of-State Costs on Small Biz

Ala.

Low

15

$1.9B

$1.2B

$0.6B

$0.4B

$0.1B

$0.3B

Alaska

Low

10

$0.4B

$0.3B

$0.1B

$0.1B

$0.0B

$0.1B

Ariz.

Low

5

$3.1B

$2.1B

$1.1B

$0.6B

$0.2B

$0.4B

Ark.

Low

5

$1.1B

$0.7B

$0.4B

$0.2B

$0.1B

$0.2B

Calif.

High

5

$58.9B

$12.5B

$46.4B

$11.8B

$9.3B

$2.5B

Colo.

High

5

$7.4B

$2.0B

$5.4B

$1.7B

$1.2B

$0.5B

Conn.

Low

5

$2.5B

$1.7B

$0.9B

$0.5B

$0.2B

$0.3B

Del.

Low

5

$0.9B

$0.6B

$0.3B

$0.2B

$0.1B

$0.1B

Fla.

Low

15

$9.5B

$6.2B

$3.3B

$2.0B

$0.7B

$1.3B

Ga.

Low

5

$5.8B

$3.8B

$2.0B

$1.1B

$0.4B

$0.7B

Hawaii

Low

5

$0.7B

$0.4B

$0.2B

$0.2B

$0.1B

$0.1B

Idaho

Low

5

$0.7B

$0.5B

$0.3B

$0.2B

$0.1B

$0.1B

Ill.

Medium

5

$9.8B

$4.8B

$5.1B

$1.9B

$1.0B

$0.9B

Ind.

Low

5

$3.5B

$2.3B

$1.2B

$0.7B

$0.2B

$0.4B

Iowa

Low

10

$2.0B

$1.3B

$0.7B

$0.4B

$0.1B

$0.3B

Kan.

Low

5

$1.7B

$1.1B

$0.6B

$0.4B

$0.1B

$0.2B

Ky.

Low

15

$1.8B

$1.2B

$0.6B

$0.3B

$0.1B

$0.2B

La.

Low

5

$2.2B

$1.5B

$0.8B

$0.5B

$0.2B

$0.3B

Maine

Low

5

$0.5B

$0.4B

$0.2B

$0.2B

$0.1B

$0.1B

Md.

Medium

10

$4.2B

$2.1B

$2.1B

$0.9B

$0.5B

$0.5B

Mass.

Medium

5

$6.4B

$3.1B

$3.3B

$1.2B

$0.6B

$0.6B

Mich.

Low

5

$4.4B

$2.9B

$1.5B

$0.9B

$0.3B

$0.6B

Minn.

Medium

5

$4.3B

$2.1B

$2.2B

$0.8B

$0.4B

$0.4B

Miss.

Low

10

$0.9B

$0.6B

$0.3B

$0.2B

$0.1B

$0.1B

Mo.

Low

10

$2.8B

$1.8B

$0.9B

$0.5B

$0.2B

$0.4B

Mont.

Low

5

$0.5B

$0.3B

$0.2B

$0.2B

$0.1B

$0.1B

Neb.

Low

5

$1.4B

$0.9B

$0.5B

$0.3B

$0.1B

$0.2B

Nev.

Low

10

$1.5B

$1.0B

$0.5B

$0.3B

$0.1B

$0.2B

N.H.

Low

5

$0.7B

$0.5B

$0.2B

$0.2B

$0.1B

$0.1B

N.J.

Low

5

$5.1B

$3.4B

$1.7B

$1.1B

$0.4B

$0.7B

N.M.

Low

15

$0.7B

$0.5B

$0.2B

$0.2B

$0.1B

$0.1B

N.Y.

Medium

5

$21.2B

$9.8B

$11.4B

$4.1B

$2.2B

$1.9B

N.C.

Medium

10

$7.1B

$3.4B

$3.6B

$1.4B

$0.7B

$0.7B

N.D.

Low

5

$0.5B

$0.3B

$0.2B

$0.1B

$0.0B

$0.1B

Ohio

Medium

5

$8.1B

$3.9B

$4.2B

$1.5B

$0.8B

$0.7B

Okla.

Low

10

$1.6B

$1.0B

$0.5B

$0.4B

$0.1B

$0.2B

Ore.

Low

5

$2.1B

$1.4B

$0.7B

$0.5B

$0.2B

$0.3B

Pa.

Medium

5

$8.9B

$4.3B

$4.6B

$1.7B

$0.9B

$0.8B

R.I.

Low

5

$0.5B

$0.3B

$0.2B

$0.1B

$0.0B

$0.1B

S.C.

Low

10

$2.0B

$1.3B

$0.7B

$0.4B

$0.1B

$0.3B

S.D.

Low

15

$0.6B

$0.4B

$0.2B

$0.2B

$0.1B

$0.1B

Tenn.

Low

5

$3.3B

$2.2B

$1.1B

$0.6B

$0.2B

$0.4B

Texas

Low

10

$15.3B

$10.0B

$5.3B

$2.9B

$1.0B

$1.9B

Utah

Low

5

$1.8B

$1.2B

$0.6B

$0.4B

$0.1B

$0.2B

Vt.

Low

10

$0.2B

$0.2B

$0.1B

$0.1B

$0.0B

$0.0B

Va.

High

10

$9.6B

$2.6B

$7.0B

$3.1B

$2.3B

$0.8B

Wash.

Low

5

$5.3B

$3.5B

$1.8B

$1.1B

$0.4B

$0.7B

W.Va.

Low

10

$0.6B

$0.4B

$0.2B

$0.1B

$0.0B

$0.1B

Wis.

Low

5

$2.8B

$1.9B

$1.0B

$0.6B

$0.2B

$0.4B

Wyo.

Low

5

$0.3B

$0.2B

$0.1B

$0.1B

$0.0B

$0.0B

USA

--

--

$239.3B

$112.2B

$127.1B

$49.5B

$26.4B

$23.1B

To avoid all these costs for businesses and confusion for consumers, ITIF urges Congress to pass a comprehensive federal privacy law that provides baseline protections for consumers and simplifies compliance for businesses while also preempting states from passing their own privacy laws.

"Your privacy rights should not change when you cross state lines. Policymakers should move quickly to pass legislation that creates a national data privacy framework," said Castro. "Consumers need basic data rights, and businesses need lawmakers to streamline regulation, preempt state laws, and minimize the impact on innovation."

Read the report:itif.org/privacy-patchwork.