How privacy rules meant to protect consumers may hurt small businesses
Laws designed to safeguard Americans’ online privacy may come with hidden costs to small businesses, according to new research co-authored byJohn G. Lynch Jr., a consumer behavior expert at theLeeds School of Business.
John Lynch
While rules modeled on Europe’s General Data Protection Regulation, or GDPR, have given people more control over their data, Lynch and his co-authors found that they can also reduce innovation, raise compliance costs and worsen inequities among consumers. The findings arrive as nearly 20 U.S. states have passed comprehensive privacy laws and Congress continues to debate federal standards.
“Privacy protections are important, but we need to recognize the trade-offs,” said Lynch, a Distinguished Professor atLeeds. “When regulations are written without considering how consumers and small firms actually use data, they can end up favoring big business and incumbents and stacking the deck against the little guy.”
These rules don't just affect businesses. They change what products reach consumers. For example, entrepreneurs have used digital targeting to launch products in markets that had previously been ignored—from nonalcoholic beer to specialized beauty products for Black women. Lynch cited Black Travel Box and Athletic Brewing Company as examples of companies that grew by reaching niche customers through personalized ads.
The study, published in August by the, pulls together findings from dozens of research papers on privacy rules worldwide. Among the findings:
- Small businesses bear the brunt. After Europe’s GDPR went into effect, smaller firms saw data storage costs rise disproportionately. One analysis found compliance raised costs by more than 20%. Moreover, small firms bear greatly increased costs of marketing and customer acquisition compared to large firms, Lynch said.
- Innovation slows. Regulations restricting the use of consumer data have been linked to a decline in new apps, venture capital investment and disruptive products. “Before digital advertising, only companies with massive budgets for TV advertising could reach consumers. Privacy rules risk rolling back the clock,” Lynch said.
- Consumers lose personalization and access. Privacy limits make it harder for firms to tailor offerings. That can reduce value for people with niche interests and sometimes exclude marginalized groups from opportunities like credit, jobs or housing. For poorer consumers, the problem is that firms unintentionally exclude them, Lynch said. Companies don’t have enough information to know those customers are likely to buy, so they don’t bother advertising to them, he said.
- The benefits tilt to the well-off. Research shows that wealthier, older and more educated consumers value privacy most. By contrast, younger and lower-income consumers often benefit more from data sharing because it gives firms the information they need to serve them better.
One of the key concerns about personalized marketing is that it will lead to discrimination against low income consumers—for example via personalized pricing, Lynch said. “In general, personalized pricing, as in airline pricing, leads to higher prices for those most able to pay: While wealthier passengers may pay more, lower-income consumers can often gain access at a price they can afford through personalized fares,” he said.
Privacy rules that limit targeted advertising, Lynch warned, risk closing off those opportunities for both consumers and small businesses. He argued that the common perception of personalization as predatory misses the bigger picture—that data often helps expand access rather than restrict it.
“It’s not that personalized marketing is ripping off consumers,” Lynch said. “The net effect is you get more coverage of the market, so poorer people can get things they previously either were not offered or couldn’t afford.”
Fairness and privacy
The paper also notes that emerging privacy-enhancing technologies, such as Google’s “Privacy Sandbox,” could balance protections with innovation.But these tools are expensive to adopt, giving large tech firms an edge while smaller companies struggle to keep pace.
Lynch said the key is designing smarter rules. “We don’t have to choose between privacy and innovation,” he said. “But regulators need to weigh unintended consequences so that protecting consumers doesn’t come at the expense of fairness, competition and opportunity.”
Europe is already reconsidering the impact of GDPR as investment and competitiveness lag, Lynch noted. The U.S. has an opportunity to learn from those missteps.
Lynch, who in 2025 received the American Marketing Association’shighest honor for distinguished marketing educators, said he hopes his team’s research will help guide policymakers toward solutions to protect people’s data without stifling the innovation that makes the digital economy thrive.
Aside from Lynch, the study’s researchers include Jean-Pierre Dubé of the University of Chicago; Dirk Bergemann of Yale University; Mert Demirer of the Massachusetts Institute of Technology; Avi Goldfarb of the University of Toronto; Garrett Johnson of Boston University; Anja Lambrecht of London Business School; Tesary Lin of Boston University; Anna Tuchman of Northwestern University; and Catherine Tucker of MIT.