Privacy regulation and firm performance: Estimating the GDPR effect globally

Abstract

This paper examines how privacy regulation shaped firm performance. Controlling for firm and country‐industry‐year unobserved characteristics, we compare the outcomes of firms at different levels of exposure to EU markets, before and after the enforcement of the General Data Protection Regulation (GDPR) in 2018. We find that the GDPR had the unintended consequence of harming the profitability of companies targeting European consumers through the cost channel. Technology firms experienced a 2.1% decline in profits, but not in sales. The GDPR increased extra expenses, added to firms wage bills, and accelerated patenting in GDPR‐related technology fields. The main burdens have been borne by smaller companies.