Thread by @geoffmanne

The gov’t of CA released its estimate of the costs/bens of the CCPA: bit.ly/2pqcyao

Bottom line costs: $55B up front & $16.5B over next 10 yrs

Bottom line benefits? Um, lots! Yeah, lots

Here’s why costs are actually much higher & benefits don’t come close. [thread]

There’s a lot of fuzziness in estimating the benefits of privacy regs to consumers, as well as the costs of compliance.

Among other things (if you can believe it) no one actually knows how many businesses CCPA will cover.

Indeed, the report estimates that somewhere between, oh, 15,643 and 570,066 CA businesses will be covered by the CCPA.

That’s… quite a margin of error.

Imagine passing a law & being *that* uncertain who it covers….

The report uses the low end of this range for its “baseline,” but also includes (more likely) estimates covering large firms plus 50% & 75% of smaller CA companies the law “might” cover.

(For reference, 80% of CA firms surveyed by @privacypros believed they’d be covered)

Also, it must be noted, the report looks at only the *incremental* costs of the CCPA.

So all of these costs are *in addition to* — not in lieu of — the costs companies already incur to comply with privacy rules.

So, the bottom line on the report's stated costs:

First, the CCPA will impose on California businesses approximately *$55 billion* in initial compliance costs.

That’s 1.8% of CA’s 2018 Gross State Product (GSP).

In addition, the CCPA will impose on California businesses another up to (and most likely) $16.45 billion over the next decade.

But here’s the rub:

None of these estimates includes costs incurred by the enormous number of companies *outside* of California to which the regulation applies:

Interestingly, @privacypros (bit.ly/2oFZDAA) estimates CCPA will reach 507,280 US firms - about the same as the report’s high-end, CA-only number.

The reality is likely higher given IAPP’s conservative calculations.

And none of this counts non-US firms, of course.

In fairness, the report also doesn’t count benefits to consumers outside CA.

But it’s debatable whether CCPA actually confers benefits...

(See @laweconcenter’s lengthy analysis of privacy regs bit.ly/2oFKv6g & @alecstapp’s takedown of CCPA bit.ly/2oFKX4s)

Anyway, that’s just *direct* costs.

The report points to GDPR compliance for reference, noting that, in addition to a substantial increase in IT budgets, GDPR has also likely led to reduced productivity.

The report provides some estimates of CCPA’s likely macro effects, dismissing them as “completely negligible in relation to the economy as a whole.”

But are they really so negligible?

Here’s the data provided by the report:

In 10 yrs CCPA could result in a loss of:

- $4.6B in GSP
- 14,000 jobs
- $9.3B in output/investment/income

CA is a big state, so these are small as a %, but tell that to the people affected.

I wonder how much privacy protection someone would give up not to be fired...?

Nor does the report count higher advertising costs.

@cetucker & @avigoldfarb suggest this is into the $billions based on their research on privacy regs' impact on ad effectiveness bit.ly/2n01IH8

Great news for Google & FB, but for advertisers & consumers? Not so much.

As for the benefits?

Well, the measurement problems here are even more significant & the report acknowledges the extreme uncertainty of any estimates of the law’s benefits.

Nevertheless, it offers a couple of possible measures.

$1.6 – 5.4B (est. based on consumers’ willingness to pay (WTP) for more app privacy)

$169M (implied value of firms’ WTP for consumers’ basic info)

$9.7B (implied value of firms’ WTP for more-sensitive info)

$12B (ARPU of personal info used for advertising in CA)

But, despite the report’s assumption to the contrary, other than the first of these, none of these metrics estimates the value of increased privacy regulation.

Rather, they estimate the potential value to firms of the underlying data.

But in no sense does CCPA somehow transfer this value to consumers.

Some of CCPA’s costliest rules require disclosure, e.g. This doesn’t inherently preserve data value.

It might trigger add’l expense to claw data back, but it doesn’t simply *confer* its value on consumers.

Indeed, much of the value of this data (and presumably all of its value to businesses) arises from its use by businesses.

So keeping it out of firms’ hands doesn’t confer that value on consumers; it *destroys* that value.

CCPA’s opt-out will impede firms’ ability to offer targeted ads & pubs’ ability to finance content w/ ads.

This means very real consumer *costs*:

Higher product prices, less info flow, &/or subscription fees. (See also Goldfarb & Tucker)

All of this is ignored by the report.

But, hey, at least CCPA allows firms to actually charge users who opt-out.

Copycat bills like one proposed in NJ (bit.ly/2nZWpYH) don’t even do that.

As @iab has noted, bit.ly/2nXORFZ, this is a big problem:

@iab So, based on the report’s one arguably valid measure of the reg’s benefits (consumer WTP for privacy), CCPA would confer:

$1.6–5.4B/yr benefit at a cost of $7.2B/yr (annualized up-front & ongoing costs over 10 yrs).

Even without all the probs above, this is... not a good deal

@cetucker @AviGoldfarb Sorry! That was supposed to be @ce_tucker and @avicgoldfarb