Mark Penn: How to save a billion and a half hours

The commentary argues that proliferating privacy-consent banners, multi-factor authentication, CAPTCHAs, mandatory account creation and lengthy terms-and-conditions are creating substantial digital friction, estimating 1.5 billion hours could be saved through simpler standards. It warns that expanding legal, privacy and liability requirements could impose similar barriers on AI services such as ChatGPT and Claude. Proposed solutions include universal device-level consent settings, biometric passkeys, AI-powered form autofill and plain-English legal summaries.

Analysis

This is not an investable near-term catalyst for AAPL; the practical implication is a gradual shift in authentication economics rather than a material earnings change. Wider passkey adoption reinforces Apple’s device-integrated identity moat: biometric credentials reduce password-reset friction, improve retention within the iOS ecosystem, and make cross-platform identity vendors less differentiated. The value capture is likely indirect—higher Services engagement and lower support/fraud costs—rather than a separately reportable revenue line over the next 1-3 quarters.

The more consequential second-order effect is pressure on standalone authentication and CAPTCHA-dependent business models as AI raises the cost of proving human identity. Cloudflare (NET), Okta (OKTA), and CyberArk (CYBR) can benefit if enterprises respond by upgrading to phishing-resistant, device-bound authentication, but they face margin and pricing risk if passkeys commoditize the basic credential layer. Winners should be vendors selling orchestration, privileged-access controls, fraud analytics, and enterprise policy management—not merely one-time-password infrastructure.

Over 6-18 months, AI-related liability and privacy rules could create a bifurcated market: consumer-facing models may incur more consent and disclosure friction, while enterprise AI vendors gain from auditable identity, permissions, and data-governance tooling. The contrarian view is that added friction is not uniformly negative: mandatory authentication and consent can improve first-party data quality and reduce bot traffic, supporting monetization for scaled platforms. The thesis fails if regulators mandate interoperable identity standards that remove ecosystem lock-in, or if a major biometric/passkey compromise reintroduces multi-step authentication.

Key Decisions for Investors

• No directional AAPL trade on this commentary alone; maintain any existing core exposure, but treat passkey adoption as a 6-18 month ecosystem-retention tailwind rather than a near-term EPS catalyst.
• Watch-list long CYBR versus short a broad cybersecurity ETF (HACK) over 6-12 months if enterprise disclosures show accelerating AI-security budgets: privileged identity management has stronger pricing power than commodity MFA. Reassess if CYBR billings growth decelerates below the sector or passkey deployment materially reduces PAM seat expansion.
• Watch NET for evidence that bot-management and identity-security attach rates rise with generative-AI traffic. Initiate only after a quarterly acceleration in security revenue/large-customer adds; risk is that AI-driven scraping is addressed through lower-margin infrastructure pricing rather than premium security products.
• Monitor regulatory developments around interoperable digital identity and AI consent requirements over the next 3-6 months. A federal or EU-style standardized consent layer would be incrementally negative for proprietary platform lock-in but positive for compliance, governance, and identity-orchestration vendors.