Privacy by Design Isn't a Compliance Cost—It's a Competitive Moat

By Atticus Smith, Legal Intern, Afissio Law

The takeaway from the first two parts is this: companies that take proactive steps to protect consumers' data can gain a real advantage over those that don't. Companies that design data minimization and consumer-rights handling into their systems before they scale, rather than retrofitting compliance later, can build an advantage that later-moving competitors struggle to copy. Companies that wait tend to incur higher costs, face greater security risk, and risk lasting damage to their credibility. When and how you build your data architecture helps determine whether privacy ends up as a sunk cost or a structural asset.

Retrofits Are Expensive

Start with the economics. Organizations surveyed by Cisco consistently report that their privacy investments generate benefits exceeding their costs: in Cisco's 2025 Data Privacy Benchmark Study, 96% of respondent organizations said the benefits outweighed the costs, and the median estimated return was 1.6 times spending.¹ Those are organizations' own estimates, but they point in a consistent direction. And as Part 2 showed, smaller, cleaner data footprints are cheaper to defend and less costly to lose. IBM's 2025 Cost of a Data Breach Report found that breaches involving data stored across multiple environments cost an average of $5.05 million, about 26% more than breaches confined to on-premises systems ($4.01 million).² Sprawl itself is a cost driver, and the best way to avoid it is a plan for when to collect data and when to delete it.

Compare two companies. Signal was built from the start to hold almost no user data; as noted in Part 2, when a federal grand jury subpoenaed it, the company could provide only account-creation and last-connection dates.³ Drizly, the alcohol delivery platform, arrived at a leaner data posture only after a breach exposed the information of about 2.5 million customers. The FTC's order requires Drizly to destroy data it doesn't need, limit future collection, and adopt and publish a data retention schedule, and it applies personally to the company's CEO.⁴ Both companies ended up with leaner data practices, but only one got there with a federal order and years of compliance obligations attached. As the Electronic Privacy Information Center has argued, data minimization is a pillar of data security: data a company never collects can't be stolen from it,⁵ and a company never has to explain to regulators why it was still holding onto that data.

Beyond Risk Avoidance

This advantage isn't purely defensive. Since 2019, Apple has built its brand identity around the slogan "Privacy. That's iPhone."⁶ In April 2021, with iOS 14.5, Apple began requiring apps to ask users' permission before tracking them across other companies' apps and websites, a policy known as App Tracking Transparency.⁷ The commercial stakes were large: in February 2022, Meta's CFO estimated that Apple's iOS changes would cost the company roughly $10 billion in 2022 revenue.⁸ That figure doesn't prove Apple gained customers because of the change, but it shows how much economic value turns on control of user data.

Smaller players illustrate the same dynamic. After WhatsApp's January 2021 policy announcement, Signal recorded about 50.6 million installs that month, up from roughly 992,000 in January 2020.⁹ DuckDuckGo passed 100 million searches in a single day that same month, on a product built around not tracking users.¹⁰ Many factors drive growth, and these numbers don't prove privacy was the cause. But they are consistent with a simple point: these companies' architecture matched decisions many consumers were ready to make.

The Process

Adopting practices like these doesn't require a company to change its entire business model. A privacy-by-design program can begin with four concrete habits:

1. Map your data before you try to minimize it. NIST's Privacy Framework places inventory and mapping at the start of its Identify function for a reason: you cannot limit what you cannot see.¹¹
2. Tie collection to a defined purpose rather than gathering everything that might someday be useful.
3. Set real retention limits and enforce them. Blackbaud and Drizly both ended up under FTC orders requiring formal retention schedules; adopting one before anyone forces you to reduces that exposure.
4. Build straightforward ways for consumers to access, correct, or delete their data and, where applicable, to opt out of its sale, sharing, or use for targeted advertising. These measures become harder to implement as systems and data stores grow. Apple, for example, offers a self-service portal where users can request a copy of their data.¹² By contrast, the government alleged that Amazon kept children's Alexa voice recordings indefinitely by default and did not always delete voice transcripts and geolocation data when users or parents asked. Amazon disputed the claims but agreed in 2023 to a $25 million civil penalty and a permanent injunction requiring it to overhaul its deletion practices.¹³

The argument, then, is limited: minimization by design is a durable advantage for the core data a business collects to run its product and earn customers' trust. It is not an argument against data use everywhere. Where fraud prevention, security, or model training genuinely require more data, the right move is a deliberate decision, documented and communicated transparently, not a default no one examined. That distinction is what separates the companies in this series that turned data handling into an asset from those that turned it into an expensive lesson, like Equifax's settlement of at least $575 million.

Atticus Smith is a legal intern at Afissio Law. This series was edited by Jerry Stephen Smith, Principal of Afissio Law.

Notes

1. Cisco, 2025 Data Privacy Benchmark Study, https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-privacy-benchmark-study-2025.pdf
2. IBM, Cost of a Data Breach 2025, https://www.ibm.com/think/insights/data-matters/cost-of-a-data-breach
3. Signal, Grand Jury Subpoena for Signal User Data, Central District of California, https://signal.org/bigbrother/central-california-grand-jury/
4. FTC, FTC Takes Action Against Drizly and Its CEO James Cory Rellas (Oct. 2022), https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million
5. EPIC, Data Minimization: A Pillar of Data Security, But More Than That Too, https://epic.org/data-minimization-a-pillar-of-data-security-but-more-than-that-too/
6. AppleInsider, "Privacy. That's iPhone." Ad Campaign Launches (Mar. 2019), https://appleinsider.com/articles/19/03/14/privacy-thats-iphone-ad-campaign-launches-highlights-apples-stance-on-user-protection
7. Apple Developer, App Tracking Transparency, https://developer.apple.com/documentation/apptrackingtransparency
8. Meta Platforms, Q4 2021 Earnings Call Transcript (Feb. 2, 2022), https://s21.q4cdn.com/399680738/files/doc_financials/2021/q4/Meta-Q4-2021-Earnings-Call-Transcript.pdf
9. Sensor Tower, WhatsApp Rivals See Nearly 1,200% Growth Ahead of Privacy Policy Deadline (May 2021), https://sensortower.com/blog/whatsapp-signal-telegram-install-growth
10. Search Engine Land, DuckDuckGo Passes 100 Million Searches in a Single Day (Jan. 2021), https://searchengineland.com/duckduckgos-focus-on-privacy-minded-users-pushes-it-past-100-million-searches-in-a-single-day-345462
11. NIST, Privacy Framework Version 1.0 Core, https://www.nist.gov/system/files/documents/2021/05/05/NIST-Privacy-Framework-V1.0-Core-PDF.pdf
12. Apple, Data and Privacy, https://privacy.apple.com/
13. U.S. Dep't of Justice, Amazon Agrees to Injunctive Relief and $25 Million Civil Penalty (May 2023), https://www.justice.gov/archives/opa/pr/amazon-agrees-injunctive-relief-and-25-million-civil-penalty-alleged-violations-childrens

Afissio Law, LLC  |  Jerry Stephen Smith, Principal

1438 W Broadway Road, Suite 101, Tempe, Arizona 85282

This article is provided for general informational purposes only and is not legal advice. Reading it does not create an attorney-client relationship.