I asked the Chief Security Officer of Expedia Group a question with a simple surface and a sharp edge: “GDPR is a good framework, and we know that the U.S. federal government is not going to jump quickly onto that level of data privacy — so why don’t companies just adopt GDPR themselves as a standard?”
If a regulation is good, and no one is making you follow it, and following it would protect your customers — what exactly is the argument for waiting?
The honest answer tells you everything about how privacy actually works inside companies. It isn’t blocked by ignorance. It’s blocked by arithmetic: privacy restraint costs money now and pays out in a disaster that might happen to somebody else, later, in a headline with a different company’s name on it.
Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:
Strategy. Adopting a recognized standard voluntarily is a strategic asset disguised as a compliance cost. The company that builds to GDPR-level discipline gets one global way of handling data instead of fifty state patches and a prayer — and gets to walk into every enterprise sales cycle, every regulator meeting, and every breach headline already holding the high ground. The strategy question was never “can we afford to adopt it?” It’s “can we afford to be the company that explained why it didn’t?”
Politics. Here’s why it doesn’t happen: the benefits of voluntary restraint are diffuse and the costs are concentrated. The data team that wants to collect less has no lobby. The growth team whose targeting depends on collecting more has a quarterly number. So the organization drifts to the common denominator — the minimum the strictest current law requires — and calls the drift a strategy. Nobody decided against privacy. The incentive structure decided, and everyone else just attended the meeting.
Innovation. The genuinely innovative move isn’t a new consent tool. It’s flipping the default: treat GDPR-grade rights — access, deletion, purpose limitation — as a product feature you ship to every customer everywhere, not a legal burden you geofence to Europe. Companies spend fortunes differentiating on privacy in their advertising. Almost none differentiate on it in their data architecture, which is the only place customers can actually verify it.
Culture. Privacy culture is measured by a single test: what happens to the employee who says “we shouldn’t collect this” in a room full of people who want to? If that sentence requires courage, you don’t have a privacy culture — you have a privacy department, which is a different and much weaker thing. The department writes policies. The culture decides whether anyone reads them before the launch, or only after the subpoena.
Execution. So here’s the machinery, and none of it needs a law: pick the strictest standard you already comply with anywhere — for most global companies, that’s GDPR — and declare it the floor everywhere, in writing, with a date. Inventory what you collect against it and delete what you can’t justify; data you don’t hold can’t be breached, subpoenaed, or misused. Then publish the gap list internally and burn it down quarter by quarter, reviewed on the same calendar as the revenue numbers. Voluntary standards fail when they’re aspirations. They work when they’re schedules.
Today, companies wait for regulators to force tomorrow’s standard at tomorrow’s prices, under tomorrow’s headlines. Tomorrow’s winners will have adopted it quietly, early, and at yesterday’s prices — and will market the receipt.
Ask yourself: if your customers could see your data practices the way your engineers see them, would you still be waiting for a law?
Sources
CXOTalk Ep. 776, “Cybersecurity Lessons from the Chief Security Officer of Expedia Group” — my question on why companies don’t adopt GDPR voluntarily (transcript): https://youtubetotranscript.com/transcript?v=1M3O3w8DLLg
Related post on this blog (the government side of the same question): “Does the United States (US) Need a Federal Equivalent to the European Union (EU)’s General Data Protection Regulation (GDPR)?” (Sep 19, 2023): https://arsalankhan.com/2023/09/19/does-the-united-states-us-need-a-federal-equivalent-to-the-european-union-eus-general-data-protection-regulation-gdpr/
Leave a Reply