By Brendan Thomas, Executive Director, Internet for Growth
America’s small businesses face a growing crisis—not from inflation or supply chain disruptions, but from an increasingly complex web of state-by-state data privacy laws. A business advertising online must comply with different consumer data laws in California, Colorado, Virginia, and at least 17 other states. Large corporations with dedicated legal teams can manage these hurdles. But for small businesses, this burden is unsustainable, raising costs, creating legal risks, and limiting growth.
Congress must enact a national privacy framework that protects consumers while providing businesses of all sizes with clear, uniform rules. Without action, further fragmentation will only benefit the biggest companies while pushing smaller players out of the digital marketplace.
An Opportunity for Smart Privacy Reform
Congress has a real opportunity to pass a national data privacy law that protects consumers while supporting a fair digital economy. The right framework would preempt conflicting state laws, prevent a damaging “private right of action”—which could lead to excessive and frivolous lawsuits by allowing individuals to sue companies directly—and ensure that businesses, especially small ones, can continue leveraging data-driven digital advertising, media, and marketing. Chairman Brett Guthrie (R-KY) of the House Energy and Commerce Committee recently announced a privacy working group, signaling a renewed commitment to a federal standard.
A well-structured privacy law should provide clarity and fairness rather than creating new obstacles. It should also acknowledge that digital advertising isn’t just about big corporations—it’s a lifeline for small businesses who rely on digital ads to reach their niche audiences, compete with larger companies, and grow their customer base on a limited budget.
The High Cost of a Fragmented Regulatory System
Unlike Fortune 500 companies, small businesses lack legal teams to navigate conflicting state privacy laws, with compliance costs often exceeding $50,000 annually—more than many spend on hiring. Similarly, large corporations can afford inefficiencies in advertising on traditional channels like print, broadcast, and radio, whereas smaller businesses cannot.
Regulations highlight the risks of complexity. California’s CCPA imposed $55 billion in initial costs, disproportionately harming small firms. Similarly, the EU’s GDPR cost firms an average of $16 million each, benefiting Big Tech while driving smaller competitors out.
A patchwork of U.S. state laws would be even worse, with The Information Technology and Innovation Foundation (ITIF) estimating $1 trillion in compliance costs over a decade. Without a federal standard, small businesses face mounting expenses, legal uncertainties, and restricted advertising access—allowing large corporations to tighten their grip.
Cupola Animal Hospitals in Tennessee, for instance, relies on digital advertising but would struggle if costly privacy laws limit data-driven marketing, benefiting corporate chains.
Proposed federal laws like American Privacy Rights Act (APRA) and American Data Privacy Protection Act (ADPPA) risk repeating these mistakes, imposing costly compliance burdens, security mandates, and legal risks. While big companies can absorb these costs, small businesses may not survive.
Artificial intelligence, Small Business Advertising, and the Consumer Experience
Artificial intelligence is reshaping digital advertising, allowing small businesses to run highly sophisticated marketing efforts without dedicated in-house teams and large marketing budgets. By automating complex tasks and optimizing ad performance, AI enhances efficiency and effectiveness, enabling small businesses to create their own ads with greater ease. Consumers, in turn, benefit from a thriving digital economy where small businesses can reach them with products and services that match their interests.
However, small businesses risk losing access to the latest tools without a clear federal privacy standard. For example, Sunset Berry Farm in West Virginia depends on digital ads to bring in families, school groups, and tourists. Without this ability, small farms like this would struggle to compete against larger, corporate-backed agricultural businesses.
Similarly, as a small media business in a rural community, Dakota Film Company in South Dakota relies on digital tools to reach national clients and compete with urban-based firms with larger marketing budgets. A fragmented regulatory system threatens to cut off this essential tool.
The Time to Act Is Now
The longer Congress delays, the worse the situation will become. More states will pass their own conflicting privacy laws, compliance costs will continue rising, and small businesses will suffer the most. A failure to act now will not only limit small businesses’ ability to compete but also hurt consumers, who deserve clear and consistent privacy protections.
Small businesses like Sunset Berry Farm, Dakota Film Company, and Cupola Animal Hospitals depend on digital tools to grow. Congress must act now to ensure privacy protections don’t come at the expense of entrepreneurship and economic growth.