Privacy Bill’s Compliance Burden Could Crush Small Firms, Critics Warn

Small-business groups warned Thursday that the American Data Shield Act, advanced by a Senate committee this week, imposes compliance machinery that large technology platforms can absorb and smaller firms cannot. The bill’s data-mapping, audit, and deletion requirements apply to any business processing records on more than 25,000 people — a threshold a single-location retailer with a loyalty program can cross in a year.

Industry analysts note that the largest platforms already built privacy-compliance departments for Europe’s rules and California’s. "The irony is that this bill entrenches the incumbents it claims to police," said Marcus Bell of the Free Enterprise Council. "A five-person e-commerce shop doesn’t have a data-protection officer."

The bill’s defenders respond that it exempts firms under $40 million in revenue from its audit provisions and phases obligations in over three years. Skeptics counter that the exemptions are narrower than advertised: the revenue test ignores pass-through data processing, and the private right of action applies regardless of company size.

Conservative legal scholars also question the delegation of rulemaking power to the Federal Trade Commission, which would define key terms such as "sensitive inference" after passage. They argue Congress is repeating a familiar pattern — announcing a principle and outsourcing the hard choices to regulators insulated from voters.

The critique is not a call for inaction. Most business groups now say they prefer one federal standard to fourteen state regimes. Their ask is narrower: raise the small-business thresholds, cabin the FTC’s definitional authority, and stage enforcement so that firms get a right to cure before litigation begins.