It’s National Data Privacy Week, which the Federal Privacy Council says is a time to talk about “respecting privacy, safeguarding data, and enabling trust.” As a longtime small-business advocate, I see this week as a time to talk about how urgently America’s small businesses need a national data privacy law — and how passing such a law would help safeguard Americans’ data and privacy, and earn their trust.
The U.S. is home to 34 million small businesses, over half of which have fewer than five employees. But “small” doesn’t mean what it used to — because today’s digital platforms and tools allow even the tiniest businesses to operate on a national scale. Digital marketplaces like Amazon and Etsy mean mom-and-pop shops can show their products to millions of customers, then quickly deliver them using the platforms’ state-of-the-art shipping services. Similarly, data-powered advertising tools let small businesses reach customers across the country, often drawing them to nifty online stores powered by e-commerce platforms like Shopify and BigCommerce.
Digital and data-powered tools have revolutionized small business — perhaps most significantly by allowing small businesses to beam digital ads to people likely interested in their products. A family-run hot-sauce business in Texas, for instance, can advertise to spice enthusiasts nationwide, while skipping those whose tastes run mild. Such “targeted” ads let small businesses generate more sales for less money, helping them grow with astonishing efficiency.
Unfortunately, targeted ads have caused some to worry they’re being “surveilled.” In reality, targeted ads are sent by computer algorithms, not people. More importantly, they’re sent to thousands of IP addresses whose data-patterns indicate a good match for a given message. That is, if you get a Texas hot-sauce ad on your phone, so will thousands of others who’ve recently searched for peppery condiments. From an individual’s perspective, targeted ads can sometimes seem unsettlingly personal. But from an advertiser’s perspective, they’re an extremely impersonal — and efficient — way of getting the right message to the right audience.
But the "surveillance" label has proven sticky, leading to years of fruitless congressional debate that’s left Americans with little understanding of how data-powered ads actually work, even less understanding of how valuable they are to small businesses — and no comprehensive national data privacy law.
In the absence of a national law, 20 U.S. states have passed 20 different state-level data privacy laws — all featuring slightly different definitions of key concepts like “harm” and “sensitive,” as well as different thresholds and requirements for compliance. It’s a nightmare for small-business owners selling to customers in different states. Unsurprisingly, compliance costs and litigation are among small-business owners’ top concerns.
The tangle of state laws isn’t just a headache for small businesses — it also makes it harder for them to compete with bigger players. That’s because the big guys can call on teams of legal, marketing, and technical experts to help navigate the enormous complexities of interstate data-privacy compliance — but small online sellers’ streamlined teams and limited budgets put such expertise out of reach.
Big businesses can also absorb the costs of fines, state-mandated website redesigns, and changes to digital marketing strategies — but the little guys can’t. And in states like California, aggressive data privacy laws have proven to be catnip for unscrupulous lawyers, who use the laws to extract sizable legal settlements from small businesses. Again, the big guys can pay the lawyers to go away. For small businesses, the costs are devastating.
Moreover, states with strict data-privacy laws — say, those requiring data-collection opt-out screens — may make it harder for their state’s businesses to compete with other states’, because consumers often abandon websites that are tough to navigate. And the stricter states’ residents may miss out on ads for things they’re actually interested in. That’s because Americans generally have no idea that opting out of data collection means opting out of relevant ads. And as it turns out, Americans overwhelmingly prefer receiving relevant ads to irrelevant ads. Not only that, but they really want small businesses to thrive.
Americans deserve an honest national data-privacy conversation about data’s real risks and rewards, followed by balanced, commonsense national data-privacy legislation. It’s time for Congress to bring citizens and small businesses to the table, listen to their concerns, and get to work crafting legislation that supersedes state laws; lets small businesses leverage data-powered tools to grow, compete, and succeed; and targets real, serious data-security risks facing Americans. This National Data Privacy week, let’s do something about safeguarding Americans’ privacy, securing their data, and earning their trust — not just talk about it.