Economics of Data Protection Policies

The widespread abuse of user privacy on websites has prompted user advocacy groups to call on governments to intervene and protect consumer rights. In this paper, we present several data protection policies including no third-party sharing and GDPR-type consent-based that policy-makers and governments can utilize to improve user surplus and/or social welfare. We use a stylized analytical model to examine the impact of privacy concerns and competition on the decisions of various entities including websites, users, and third-parties under the policies. We find that consent-based policies may have the opposite and unintended effect of increasing the number of third-parties, and thus, the sharing of user information. Whereas in the absence of market entry and exit, policies may benefit social welfare, considering the impact of such policies on entry and exit of websites is shown to be an important factor. We also provide an empirical investigation of our findings about the impact of competition and consent-based policies on third-parties.