Economic Framework for Analyzing Digital Privacy
The economic literature on digital privacy has analyzed information flows and examined the benefits and costs of such flows, as well as the economic impact of restrictions imposed on those flows. The potential benefits and costs of information flows affect both consumers and firms. Digital technologies allow firms to collect and process consumer data, which can be used to provide insights about consumers, offer customers valuable products and services, develop sophisticated pricing strategies, or target advertising more effectively. Given these uses, flows of data – between consumers and firms and among firms – have the potential to create value for consumers and firms alike. However, consumers may prefer to restrict such flows because they have an intrinsic distaste for the collection and use of personal information or because they fear that it may lead to worse economic outcomes for themselves (e.g., higher prices). Firms also face costs to harness data flows. They need to develop adequate infrastructure to collect, store, and analyze data, and devote resources to protect data from cyberattacks and to comply with existing regulations. Accordingly, an economic understanding of privacy needs to consider the benefits and costs associated with data flows and evaluate the tradeoffs that arise from restricting these flows.
In addition to direct costs and benefits to consumers and firms, an economic understanding of privacy needs to consider certain economic features that are peculiar to data flows. Data sharing can cause spillovers to third parties, leading to both positive and negative externalities. A positive externality could be innovation based on insights drawn from new data. A negative externality could arise when one person shares data that reveals information about others. Solutions to externalities that rely on assigning property rights are difficult to implement in practice in the digital domain. In addition, businesses that collect and analyze data may be subject to economies of scale and scope that give rise to competitive concerns.
Empirical Evidence on Effects of Privacy Regulation
Multiple studies have evaluated the impacts of privacy regulations on firms and consumers. A pioneering 2011 study by Avi Goldfarb and Catherine Tucker examined the impact of the European Union (EU) ePrivacy Directive. Implemented in 2004, this directive imposed rules that limited the types of data advertisers could use to target ads in the EU. Using data on advertising campaigns inside and outside the EU, the study showed a significant decrease in the effectiveness of banner ads – as measured by changes in survey respondents’ stated purchase intentions – following the directive’s implementation. These results suggest that the regulation functioned as intended: firms likely used less data to target ads, which in turn made ads less effective. At the same time, reduced advertising effectiveness may have resulted in less relevant ads for users and may have hampered the growth of the online advertising industry in Europe relative to the United States.
Additional evidence about the costs of privacy regulation has emerged from academic research that examines the impact of the EU General Data Protection Regulation (GDPR). Implemented in 2018, the GDPR is one of the most significant privacy regulations enacted to date. Empirical studies of the effects of GDPR have documented outcomes that are consistent with a reduction in data flows, accompanied by potentially adverse economic outcomes. For example, using a multi-country consumer panel, Zhao et al. (2023) finds that, post-GDPR, EU consumers expended greater effort in online searches – as measured by total time spent, number of search terms, or number of sites and domains visited in a given search session – without substantial changes in their purchasing behavior, suggesting that the efficacy of consumers’ online searches had decreased. Zhao et al. (2023) also finds that, post-GDPR, EU consumers became more likely to visit and purchase online from larger firms rather than smaller ones, suggesting that larger firms may have benefitted from less effective searches while smaller firms may have been left at a competitive disadvantage. Goldberg et al. (2024) studies the effect of GDPR using website analytics and documents reductions in e-commerce revenue, post GDPR, with more pronounced effects for smaller firms. Other studies looking at the effect of GDPR on firms find reduced investment, fewer new app launches, and a softening of competition in the online advertising market in favor of large incumbents. Evidence on direct consumer benefits from the increased privacy protections of GDPR has, so far, proven to be more elusive, as these benefits are hard to evaluate empirically with the type of data available to researchers.
Researchers have also analyzed regulatory changes in the United States, in particular the 2019 settlement of an enforcement action involving a large technology firm under the federal Children’s Online Privacy Protection Act (COPPA), and the 2020 introduction of the California Consumer Privacy Law (CCPA). The findings emerging from this literature, which examines the economic consequences of these changes rather than direct privacy benefits for consumers, are broadly consistent with what has been learned from the experience of the GDPR. Privacy regulations can reduce the flow of data but can be accompanied by lower innovation, reduced consumer choice, and less personalization. In addition, regulations can have differential effects on firms, with gains in market shares for firms that are better equipped to face the new regulatory environment.
Conclusion
Both economic theory and recent empirical studies of the effects of privacy regulations point to a tradeoff between strengthening privacy protections and incurring costs in terms of reduced competition, innovation, and consumer choice relating to digital products. The findings from existing economic research can help policymakers understand these costs and benefits better and help them with the complex balancing act between protecting privacy and the potential drawbacks of restricting data flows. Future research can illuminate these costs and benefits further and assess how they may change as technological capabilities continue to improve (e.g., with the development of new privacy-enhancing technologies) and as privacy regulations evolve.
