Having one regulator is simpler than having 50. But whether it is better for business depends on how the federal regulator makes decisions, and what those decisions are. For instance, if the US regulator were to apply the most stringent standard in any state, then the single standard would be worse for business. Or if the US regulatory were to impose a single standard, which did not make business sense for any number of consumers, that would also be bad for business. The same questions about regulatory authority would apply at the state level versus the local level, by the way, and there is a TON of regulation at the local level.

FYI, this is something we discuss frequently in the insurance industry, where each and every state has an onerous consumer protection regime, yet most participants prefer the current situation over a federal solution. I would emphasize that many, many companies (in many, many industries) today decline to enter CA, NY, and other states they believe are regulatory nightmares, either in total or for specific products. You say that's a decision only a fool would make... which would mean there are a lot of successful fools in business today.

Reality is most businesses are small businesses that serve small geographies. As winners expand, they do their best to intelligently select where to go, as capital for expansion is typically quite limited. If you intended to refer to "business" as only the very small subset of American businesses that are successful selling a single product across the entire country, or perhaps could be but for a 50-state or however-many-locality regulatory scheme, then I get it. You would be right that, were an industry centrally regulated, the largest companies in that industry would be even bigger winners. But I think good politics is fostering an environment that encourages competition with large incumbents, not one that accelerates monopoly development.

Regardless, I missed the language in the Constitution that authorizes the federal government to set privacy or cybersecurity standards. Congress can't delegate authority it doesn't have, so at least that example would fail in my view. FWIW, I don't think the commerce clause was intended to, or should be read to, provide the federal government unlimited regulatory power over any thing or action involving commerce. Also in the FWIW category, I think we the people talk far too much about what "government" should or should not do, and far too little about which of the governments that regulates each us should have which power. As travel and communication across local, state and national lines become cheaper and easier, the need to force nationwide standards greatly diminishes in my view. Anyway, if this decision gets people talking more about structure and where governmental power should reside (not whether it should exist, but where it should reside), then I think that would be a great thing. I will share as an example that, other than truly foundational items, I've never had the desire to impose my preferences on people who choose to live in Mississippi.