Privacy & Market Concentration: Intended & Unintended Consequences of the GDPR

Garrett A. Johnson, Scott K. Shriver, and Samuel G. Goldberg (2023) "Privacy & market concentration: Intended & unintended consequences of the GDPR" Management Science, 69(10): 5695-5721.

57 Pages Posted: 15 Nov 2019 Last revised: 26 Dec 2023

See all articles by Garrett Johnson

Garrett Johnson

Questrom School of Business

Scott Shriver

University of Colorado at Boulder - Department of Marketing

Samuel Goldberg

Stanford Institute for Economic Policy Research

Date Written: November 14, 2022

Abstract

We show that websites' vendor use falls after the European Union's General Data Protection Regulation (GDPR), but that market concentration also increases among technology vendors that provide support services to websites. We collect panel data on the web technology vendors selected by more than 27,000 top websites internationally. The week after the GDPR's enforcement, website use of web technology vendors falls by 15% for EU residents. Websites are relatively more likely to retain top vendors, which increases the concentration of the vendor market by 17%. Increased concentration predominantly arises among vendors that use personal data such as cookies, and from the increased relative shares of Facebook and Google-owned vendors, but not from website consent requests. Though the aggregate changes in vendor use and vendor concentration dissipate by the end of 2018, we find that the GDPR impact persists in the advertising vendor category most scrutinized by regulators. Our findings shed light on potential explanations for the sudden drop and subsequent rebound in vendor usage.

Keywords: Privacy, GDPR, Competition, Web Technology, Regulatory compliance

JEL Classification: D04, K21, L11, L22, L51, L86, M30, M38, O38

Suggested Citation

Johnson, Garrett and Shriver, Scott and Goldberg, Samuel, Privacy & Market Concentration: Intended & Unintended Consequences of the GDPR (November 14, 2022). Garrett A. Johnson, Scott K. Shriver, and Samuel G. Goldberg (2023) "Privacy & market concentration: Intended & unintended consequences of the GDPR" Management Science, 69(10): 5695-5721., Available at SSRN: https://ssrn.com/abstract=3477686 or http://dx.doi.org/10.2139/ssrn.3477686

Garrett Johnson (Contact Author)

Questrom School of Business ( email )

595 Commonwealth Avenue
Boston, MA 02215
United States
6173534677 (Phone)

HOME PAGE: http://www.bu.edu/questrom/faculty-research/faculty-directory/garrett-johnson/

Scott Shriver

University of Colorado at Boulder - Department of Marketing ( email )

995 Regent Dr
Boulder, CO 80309
United States

HOME PAGE: http://https://www.colorado.edu/business/scott-shriver

Samuel Goldberg

Stanford Institute for Economic Policy Research ( email )

366 Galvez Street
John A. and Cynthia Fry Gunn Building
Stanford, CA CA 94305
United States

Do you have negative results from your research you’d like to share?

Paper statistics

Downloads
3,563
Abstract Views
15,117
Rank
5,954
PlumX Metrics