Regulating Privacy Online: An Economic Evaluation of the GDPR

51 Pages Posted: 18 Jul 2019 Last revised: 29 Mar 2021

See all articles by Samuel Goldberg

Samuel Goldberg

Kellogg School of Management, Northwestern University

Garrett Johnson

Questrom School of Business

Scott Shriver

University of Colorado at Boulder - Department of Marketing

Date Written: July 17, 2019

Abstract

Modern websites rely on personal data to design better content and to market themselves. The European Union’s General Data Protection Regulation (GDPR) was intended to make access to such personal data much more difficult, with the goal of protecting user privacy. We examine the GDPR's impact on website pageviews and revenue for 1,084 diverse online firms using data from Adobe's website analytics platform. Using a panel differences approach, we find a reduction of approximately 12% in both EU user website pageviews and website e-commerce revenue recorded by the platform after the GDPR's enforcement deadline. To understand the policy's impact, we must separate the GDPR's effects on real outcomes from its impact on data recording. We derive informative bounds on both components by first examining site-usage patterns of selected users that we continue to observe post-GDPR. We bound changes to data recording, attributed to users opting-out of data collection, to be between 4% and 15%. This implies that at least 7% of our GDPR estimates (0.8% of total) arise from the consent effect on data recording. We then find larger effects on traffic from email and display ad marketing channels—specific targets of the GDPR. We conclude that at least 8% of our GDPR estimates (0.4% of total) arise from the GDPR's real effect on marketing alone. However, we do not find evidence that consent interfaces dissuade users from browsing sites.

Keywords: Privacy, Regulation, EU, GDPR

JEL Classification: D04, K20, L50, L51, L86, M31, M38, O38

Suggested Citation

Goldberg, Samuel and Johnson, Garrett and Shriver, Scott, Regulating Privacy Online: An Economic Evaluation of the GDPR (July 17, 2019). Available at SSRN: https://ssrn.com/abstract=3421731 or http://dx.doi.org/10.2139/ssrn.3421731

Samuel Goldberg (Contact Author)

Kellogg School of Management, Northwestern University ( email )

Kellogg School of Management
2001 Sheridan Rd.
Evanston, IL 60208
United States

Garrett Johnson

Questrom School of Business ( email )

595 Commonwealth Avenue
Boston, MA 02215
United States
6173534677 (Phone)

HOME PAGE: http://www.bu.edu/questrom/faculty-research/faculty-directory/garrett-johnson/

Scott Shriver

University of Colorado at Boulder - Department of Marketing ( email )

995 Regent Dr
Boulder, CO 80309
United States

HOME PAGE: http://https://www.colorado.edu/business/scott-shriver

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
1,748
Abstract Views
7,251
rank
11,837
PlumX Metrics