▪ Privacy regulations carry two sets of costs: compliance costs imposed directly on businesses and “hidden costs” that affect the entire economy.

▪ Proponents of an approach that mimics the General Data Protection Regulation (GDPR) in the United States ignore the significant costs of such a law and the impact of higher compliance costs on businesses and consumers.

▪ A GDPR-style law would cost the U.S. $122 billion per year, including $106 billion in hidden costs. A more targeted, but still effective law would cost $6 billion per year, 95 percent less.

▪ Congress should pass federal data privacy legislation that preempts state laws, addresses specific privacy-related harms, distinguishes between sensitive and nonsensitve personal data, and does not contain a private right of action.