Privacy and Market Concentration: Intended and Unintended Consequences of the GDPR

Abstract

We show that websites’ vendor use falls after the European Union’s (EU’s) General Data Protection Regulation (GDPR), but that market concentration also increases among technology vendors that provide support services to websites. We collect panel data on the web technology vendors selected by more than 27,000 top websites internationally. The week after the GDPR’s enforcement, website use of web technology vendors falls by 15% for EU residents. Websites are relatively more likely to retain top vendors, which increases the concentration of the vendor market by 17%. Increased concentration predominantly arises among vendors that use personal data, such as cookies, and from the increased relative shares of Facebook and Google-owned vendors, but not from website consent requests. Although the aggregate changes in vendor use and vendor concentration dissipate by the end of 2018, we find that the GDPR impact persists in the advertising vendor category most scrutinized by regulators. Our findings shed light on potential explanations for the sudden drop and subsequent rebound in vendor usage. This paper was accepted by Matthew Shum, marketing. Funding: Financial support from the Marketing Science Institute and the George Mason University Program on Economics & Privacy is gratefully acknowledged. Supplemental Material: The web appendix and data are available at https://doi.org/10.1287/mnsc.2023.4709 .

<div> Does Privacy Regulation Harm Content Providers?&nbsp; </div> <div> <br> </div> <div> A Longitudinal Analysis of the Impact of the GDPR </div>

“…Those initial reductions are followed, several months after the enactment of the regulation, by a trend reversal and an uptick in tracking among EU websites. In fact, we also find evidence that an initial increase in concentration in the EU market of third-party data trackers immediately after the enactment of the GDPR (an increase consistent with post-GDPR concentration dynamics documented by prior studies of the GDPR: Johnson and Shriver (2019); Peukert et al (2020)) was followed by re-entry of numerous market players several months thereafter.…”

“…One of the earliest studies in this stream found that the GDPR led to a decrease in investments in EU emerging technologies compared to US organizations (Jia et al, 2021). Similar negative economic outcomes of the regulation have been reported in the literature, including drops in European web traffic and e-commerce revenues (Goldberg et al, 2021), an increase in concentration among web technology vendors (Johnson and Shriver, 2019), an increase in search costs among users covered by the GDPR (Zhao et al, 2022), and reduction of consumer surplus on the apps market due to more apps leaving the market and fewer ones entering (Janssen et al, 2022). Despite these early empirical findings, theoretical work has raised the prospect that the economic impact of the GDPR may be more nuanced than industry expectations.…”

“…With stiff fines for non-compliance, the GDPR could significantly impact the collection and use of personal data both within and outside EU markets. Since its implementation, much empirical attention has been devoted to capturing the GDPR's direct impacts -such as degrees of firms' compliance, changes in online consent mechanisms, and variations in flows of personal data across the advertising ecosystem (Degeling et al, 2019;Johnson and Shriver, 2019;Aridor et al, 2020;Peukert et al, 2020;Jia et al, 2021;Goldberg et al, 2021;Godinho de Matos and Adjerid, 2022;Lukic et al, 2022). Relatively less attention has been devoted to understanding downstream consequences the regulation might have on economically relevant metrics, such as the ability of online publishers to produce new, quality content.…”

“…1 The online advertising industry was expected to be especially affected by the GDPR, since its growth is driven by the ability to track users' online behavior to deliver personalized advertising. Limitations on data collection (such as those imposed by the GDPR-see Section 3) may decrease the effectiveness of online advertising campaigns (Goldfarb and Tucker, 2011), depress ad spending, 2 and result in market concentrationfavoring dominant players (Johnson and Shriver, 2019). In turn, reductions in advertising effectiveness, spending, and competition could ultimately harm online content providers, as advertising is a major revenue component for producers of digital goods (Lambrecht et al, 2014).…”

KI-Regulierung durch die EU : Eine Einschätzung der Regulierungsvorschläge der EU-Kommission vom April 2021 aus ökonomischer Perspektive

“…Der Markt der Künstlichen Intelligenz besteht aus mehreren Ebenen: Mit dem EU-Regulierungsvorschlag kommen erhöhte Compliance-Kosten auf die Anbieter und Entwickler von KI-Anwendungen zu. Compliance-Kosten verringern den Anreiz für kleine Unternehmen, in einen Markt neu einzutreten, wie in dem Zusammenhang mit Datenschutzregeln bereits gezeigt wurde (Campbell et al, 2015;Johnson & Shriver, 2020).…”