Cash Substitution and Deferred Consumption as Data-Breach Harms

Federal courts are divided over whether consumers whose data are obtained in a breach suffer an injury in fact that gives them standing to sue under Article III of the US Constitution. Judicial opinions find no constitutional standing in a narrow majority of such cases, and plaintiffs are likely to lose absent causal links to subsequent identity theft or the disclosure of embarrassing information. Our paper identifies a novel injury that results from data breaches. Upon learning about local data breaches, consumers immediately and temporarily reduce their purchases and shift from credit card purchases to cash transactions.

After a data breach, many consumers forgo the benefits of a short-term loan from their credit card issuer, cash-back benefits, and other perks associated with card purchases. In light of our empirical results, the standing barrier that has thwarted so many data-breach suits in federal court may be easily surmounted.