ITIF: 50 State Privacy Laws Could Cost $1T in 10 Years

A hypothetical 50-state privacy law patchwork could cost more than $1 trillion over 10 years, estimated an Information Technology and Innovation Foundation report Monday. California, Virginia and Colorado have comprehensive privacy laws; 15-plus states are considering bills this year (see 2201120021). ITIF estimated California’s privacy law will cost $78 billion annually. The think tank modeled a scenario where all 50 states enacted privacy laws over 15 years, and the report assumes “not all states would implement identical laws and early adopters would likely favor stricter policies, whereas laggard states would expectedly favor less-stringent consumer privacy laws.” ITIF’s “intention is to estimate the costs if the U.S. continues down this path of state-led privacy laws” and isn’t “trying (or claiming) to predict the future in terms of what states might do,” emailed ITIF Vice President Daniel Castro. Compliance “is almost always a moving target,” he said. “Even similar laws often have some differences and businesses must hire lawyers or other professionals to resolve those differences and ensure they are in compliance.” For example, even though California’s law and Europe’s Global Data Protection Act are similar, “many U.S. businesses will have separate rules (and terms in their privacy policies) for users in California versus those in the European Union,” he said.