The people's voice of reason
The people's voice of reason
Every day, thousands of American small businesses operate under false assumptions about their compliance obligations. Many believe that being a U.S. business means following only federal law or that serving primarily domestic customers exempts them from international regulations such as, for example, the GDPR.
In truth, digital compliance isn’t just about crossing borders; it’s also about crossing state lines. States such as California, Colorado, and Virginia have enacted their own privacy laws, each with distinct requirements and enforcement mechanisms.
Add to this the enforcement of federal accessibility standards, international data laws, and industry-specific rules, and it becomes clear that compliance obligations are determined by a complex intersection of factors, business location, visitor location, data practices, business size, industry type, and more.
Clym examines how businesses understand, or rather misunderstand, their compliance obligations, revealing a troubling gap between complex regulatory reality and simplified business assumptions.
The scope of the misunderstanding becomes clear when examining how business owners think about compliance versus how regulations actually work.
Many small businesses start from the wrong assumption when it comes to their compliance obligations:
Compliance obligations are determined by multiple intersecting factors:
Research into compliance awareness reveals systematic misunderstandings about these multi-factor triggers:
When presented with scenarios involving multiple factors, many small business owners:
This isn't simple ignorance of specific regulations; it's rather a fundamental misunderstanding of how modern compliance obligations are determined.
Several systemic factors have created this widespread misunderstanding:
Oversimplified business education: Standard business education still teaches compliance as location-based: "Your business operates in Texas, so you follow Texas and federal law." This framework made sense in a pre-Internet economy but fails nowadays to capture digital compliance reality. MBA programs, business courses, and startup guides rarely address the multi-factor nature of modern compliance.
Misleading marketing: Some compliance tool providers market solutions with oversimplified messaging: "GDPR compliance for your website" or "Get CCPA compliant" without explaining the complex factors that determine whether these regulations actually apply to a specific business. This reinforces simplified mental models.
Platform provider silence: Website platforms, e-commerce systems, and SaaS providers rarely educate users about compliance factors. A business can launch a website that collects personal data, uses tracking technologies, and is accessible globally without any guidance about the multi-factor triggers that might create compliance obligations.
Regulatory communication gaps: Regulators publish detailed guidance about their regulations, but rarely explain clearly how to determine whether those regulations apply to a specific business with a specific combination of characteristics. The GDPR guidance from the EU’s authorities is comprehensive but complex. Small business owners struggle to determine if GDPR applies to them specifically.
Professional service limitations: Most small businesses rely on generalist business attorneys and accountants who may not specialize in digital compliance. These professionals often apply traditional location-based thinking to digital contexts, missing the multi-factor complexity.
Consider a real-world pattern: A small U.S. e-commerce business (30 employees, $3 million annual revenue) that sells consumer products online.
The owner's assumption: "We're a U.S. business selling to U.S. customers primarily, so we need to follow U.S. e-commerce law and maybe basic website accessibility."
The reality: Traffic analysis of the business reveals the following:
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): Likely doesn't apply yet; the business is below the $25 million revenue threshold and probably doesn't meet other thresholds, but if traffic in California grows or if the business starts selling personal data, the status could change.
General Data Protection Regulation (GDPR): Likely applies; the business is "offering goods or services" to EU residents, i.e. they accept orders from the EU, and process the personal data of EU customers. No size exemption exists. Lack of active EU targeting doesn't exempt them.
U.K. GDPR: Applies based on a similar logic to that of the GDPR; accepting U.K. orders means the business is offering services to U.K. residents.
Personal Information Protection and Electronic Documents Act (PIPEDA): May apply for Canadian customer transactions; Canada's federal privacy law applies to commercial activities involving personal information.
Americans with Disabilities Act (ADA) – Website Accessibility: Most likely applies; a U.S. business operating a commercial website is increasingly interpreted by courts as a "place of public accommodation" that is required to be accessible.
Accessibility for Ontarians with Disabilities Act (AODA): May apply if the business has an organizational presence in Ontario or falls under the AODA's scope for organizations serving Ontario residents.
Payment Card Industry Data Security Standard (PCI DSS): Definitely applies; collecting payment card information triggers Payment Card Industry Data Security Standards regardless of location or size.
The business owner's simplified location-based assumption missed most of these obligations, each triggered by different factor combinations.
Regulators and courts consider multiple factors when determining jurisdiction and applicability:
GDPR enforcement: European Data Protection Authorities enforce based on:
The size and location of the business’s headquarters are not limiting factors; small US businesses have received GDPR fines.
CCPA/CPRA enforcement: California's Attorney General enforces based on:
A business doesn't need California offices to be subject to CCPA if it meets thresholds and collects California resident data.
ADA website accessibility: Federal courts increasingly find jurisdiction based on:
Where website visitors are located is less relevant than whether the business itself has a U.S. presence.
Operating under false assumptions about what triggers compliance obligations creates several risks:
False security: Businesses believe they're exempt when they're actually covered. "We're too small for the GDPR," although no size exemption exists, or "We don't target Europe," despite the fact that accepting European orders can be sufficient.
Misprioritized resources: Businesses may invest in compliance for regulations that don't apply while ignoring ones that do. A U.S. business might implement CCPA compliance, despite being below thresholds, while ignoring the GDPR, which has no threshold.
Incomplete implementation: Businesses might implement a single-factor solution, i.e. a cookie banner for visitor location, while missing obligations triggered by other factors, such as industry-specific consent requirements, or accessibility for the business’s location.
Growth surprises: As businesses grow, they may suddenly meet thresholds or triggers they weren't monitoring. Crossing $25 million in revenue suddenly triggers the need for CCPA compliance. Expanding product lines into health-related services triggers the obligation to comply with HIPAA.
Addressing the multi-factor complexity gap requires tools and approaches such as:
Comprehensive factor analysis: Rather than asking just "where are my visitors from?", effective assessment requires analyzing:
Threshold tracking: Monitoring when your business approaches regulatory thresholds, such as revenue limits, data volume limits, employee counts, so compliance can be planned before obligations trigger.
Factor combination logic: It is important to understand that different regulations use different combinations of factors. For example, the GDPR primarily cares about EU data subjects’ data + offering services, the CCPA cares about the data of California residents + business size thresholds, and the ADA cares about the U.S. business presence + public accommodation status.
Closing the compliance understanding gap requires systemic changes:
1. Education reform: Business education must evolve from location-based compliance models to multi-factor frameworks that reflect digital reality.
2. Regulatory clarity: Regulators should provide clear, accessible guidance, specifically on applicability and not just on compliance requirements, in order to help businesses determine whether the regulation applies to a specific business profile.
3. Platform responsibility: Website and e-commerce platforms should help users understand which factors might trigger compliance obligations based on their business setup.
4. Professional development: Business attorneys, accountants, and advisors need specialized training in digital compliance's multi-factor nature.
5. Assessment tools: Businesses need accessible tools that analyze multiple factors simultaneously to determine applicable obligations.
The digital compliance gap exists not just because businesses don't know about specific regulations, but because they don't understand the multi-factor framework that determines which regulations apply to them.
A U.S. business might assume its obligations are limited to U.S. law, missing GDPR obligations triggered by EU visitor data. A small business might assume size exempts it from regulations that have no size threshold. A business not targeting a market might assume it has no obligations to users from that market who nonetheless use its services.
Closing this gap requires moving beyond simplified location-based thinking to understand that compliance obligations emerge from the intersection of multiple factors: where you operate, where your users are, what you do, what data you collect, how large you are, and what industry you serve.
The first step is recognizing that compliance isn't simple.
The second step is conducting a comprehensive, multi-factor assessment to analyze all relevant factors, not just one or two.
The third step is implementing compliance based on your actual obligations, not assumptions about what should apply.
Until business education, regulatory guidance, and assessment tools all reflect the multi-factor reality of digital compliance, the gap will persist, leaving thousands of businesses unknowingly exposed to regulations they don't even know apply to them.
This story was produced by Clym and reviewed and distributed by Stacker.
Reader Comments(0)