Extreme Data Restrictions: What Small Businesses Need to Know

Across the country, lawmakers are considering — and passing — strict new laws that dramatically limit how businesses can collect and use basic customer data. Intended to protect consumers’ privacy, these “data minimization” provisions seriously disrupt online advertising and marketing — making it much harder for small businesses to find customers, grow, and compete. 

How Do The New Data Restrictions Affect Small Businesses?

Most data privacy legislation — including gold-standard laws enacted in California and the European Union — allow customers to opt-in to some data collection. But many of the new proposals, including those in Maryland and Massachusetts, say businesses can only collect and use data to provide a specific product or service requested by a customer, such as completing a single transaction. 

In today’s digital economy, this kind of overregulation of basic data has serious consequences for small businesses. That’s because small businesses use data to do important things like send ads to interested customers, understand which ads and marketing tactics are working, and provide personalized customer service.

Here’s what these types of data restrictions could look like in practice for small businesses:

• If a customer bought a shirt from a local shop, the shop couldn’t use purchase data to email them when matching ties arrived — unless the customer had specifically requested that they do so.
• If someone registered for a class at a neighborhood exercise studio, the studio couldn’t use registration data to share information about a similar class they might like.
• If you run an ad for running shoes, your digital advertising partners might not be able to use browsing data to ensure it reaches people actually searching for running shoes. 
• A contractor wouldn’t be able to use website traffic data to figure out which neighborhoods to advertise in.
• A baker couldn’t email customers about seasonal specials unless each person specifically requested it. 

Basic, non-personally identifiable data helps millions of small businesses connect with customers, grow, and succeed. By the same token, restrictions on data-use:

• Make digital ads less effective and more expensive by reducing the data available to power targeted ad campaigns.
• Make it harder to tell existing customers about new products and deals by limiting businesses’ ability to use past purchase data.
• Make it harder to understand which ads are working by limiting the use of data for analytic purposes.
• Prevent small businesses from using data to inform key decisions about things like where to open a new store location or focus their limited marketing budgets.

Data-use restrictions mean businesses have to spend more money to reach the same number of customers. That hurts their bottom line and makes it harder for them to grow. And because the restrictions also make it harder for businesses to engage in smart, tailored marketing, customers may also miss out on useful information. The restrictions do little to make consumers safer online, but they do lots to hurt small businesses.

Many Proposals Include Flawed Exemptions and Introduce New Legal Risk for SMBs

Some data restriction proposals claim to exempt small businesses, but the exemptions are largely meaningless. For instance, the American Privacy Rights Act (APRA), a national bill introduced in 2024, exempts companies handling data on fewer than 200,000 people per year. But data is generated every time someone visits a company’s website or clicks on a digital ad, so even the smallest businesses often exceed that threshold. And those that don’t would still be affected because their larger digital partners — platforms like Google and Shopify that provide advertising, analytics, and e-commerce support — would be subject to the restrictions. If those partners can’t provide effective data-powered advertising or data analytics, small businesses will struggle to reach and engage customers.

Many bills also let consumers sue businesses directly over alleged violations. In the past, that has led to expensive lawsuits and settlements even for businesses that did nothing wrong. 

A Better Way Forward

Lawmakers in lots of states have said “no” to extreme data-restriction proposals — in large part because of worries that they might hurt small businesses. But many states have already enacted overly broad bills — and more states are actively considering similar bills.

States like Connecticut have shown that it’s possible to craft privacy rules that protect consumers without hurting small businesses. Clear, balanced policies can preserve the benefits of data-powered tools — helping small businesses find customers, compete with larger companies, and grow — while safeguarding personal information.Moving forward, small-business owners should share their stories with lawmakers to ensure privacy laws protect consumers without unintentionally hurting small and local businesses that keep our communities strong. Check out our Advocacy Toolkit for practical tips and resources to help you engage lawmakers and make your voice heard.