ISSN (Print) 0473-453X

Discussion Paper No. 1246

ISSN (Online) 2435-0982

THE BRIGHT SIDE OF THE GDPR:
WELFARE-IMPROVINGPRIVACY MANAGEMENT

Chongwoo Choe
Noriaki Matsushima
Shiva Shekhar

June 2024

The Institute of Social and Economic Research
Osaka University
6-1 Mihogaoka, Ibaraki, Osaka 567-0047, Japan

The Bright Side of the GDPR:
Welfare-improving Privacy Management∗
Chongwoo Choe†

Noriaki Matsushima‡

Shiva Shekhar§

June 26, 2024

Abstract
We study the GDPR’s opt-in requirement in a model with a firm that provides a digital
service and consumers who are heterogeneous in their valuations of the firm’s service aswell as the privacy costs incurred when sharing personal data with the firm. We show that
the GDPR boosts demand for the service by allowing consumers with high privacy costs
to buy the service without sharing data. The increased demand leads to a higher price
but a smaller quantity of shared data. If the firm’s revenue is largely usage-based rather
than data-based, then both the firm’s profit and consumer surplus increase after the GDPR,
implying that the GDPR can be welfare-improving. But if the firm’s revenue is largely fromdata monetization, then the GDPR can reduce the firm’s profit and consumer surplus.
JEL Classification: D18, D61, K24, L12, L51, L86.
Keywords: GDPR, opt-in, opt-out, privacy management, welfare∗

We have benefited from helpful comments from Cédric Argenton, Joshua Gans, Clara Graziano, Hooman
Hidaji, Ulrich Laitenberger, Melika Liporace, Keizo Mizuno, Barry R. Nault, Jens Prüfer, Markus Reisinger,
Susumu Sato, Florian Schuett, Radostina Shopova, Tat-How Teh, Mark Tremblay, Vaarun Vijairaghavan, Chengsi
Wang, as well as participants at numerous conferences, seminars, and workshops. We gratefully acknowledge
financial support from the Australian Research Council (grant number DP210102015), the Japan Society for
the Promotion of Science (KAKENHI grant numbers JP20H05631, JP21H00702, JP21K01452, JP21K18430,
JP23H00818, JP23K20593, and JP23K25515), Nomura Foundation, the International Joint Research Promotion
Program at Osaka University, and the program of the Joint Usage/Research Center for “Behavioral Economics”
at the ISER, Osaka University. Although Matsushima serves as a member of the Competition Policy ResearchCenter at the Japan Fair Trade Commission (JFTC), the views expressed in this paper are solely ours and should
not be attributed to the JFTC. The usual disclaimer applies.
†
Department of Economics, Monash University. Email: chongwoo.choe@monash.edu.
‡
Institute of Social and Economic Research, Osaka University. Email: nmatsush@iser.osaka-u.ac.jp.
§
The corresponding author. Tilburg School of Economics and Management (TiSEM), CESifo Research affiliate. Email: s.shekhar 1@tilburguniversity.edu, shiva.shekhar.g@gmail.com.

1

1

Introduction

The European Union (EU)’s General Data Protection Regulation (GDPR) is generally considered to be the most stringent law that governs personal data protection, and is setting a global
standard for privacy regulations.1 Before the GDPR went into effect in 2018, many consumers
had little control over their data in the digital space. For example, privacy regulations such as
the EU’s Data Protection Directive (Directive 95/46/EC) or Australia’s Privacy Act 1988 werebased on principles and guidelines, which were non-binding and not specific enough; nor were
they entirely fit for the digital age. As a result, online businesses collected and processed personal data without providing clear information to consumers as to what data is collected, how
it is used, and with whom it is shared. Data collection was often set as the default option, fromwhich consumers could not easily opt out. The GDPR superseded the EU’s Data Protection
Directive with more specific data protection requirements, stiffer enforcements, and penalties for
non-compliance. In addition, to rectify the opaque data collection process, the GDPR (Article
7, Recital 32) requires businesses to allow consumers to make a “freely given, specific, informed
and unambiguous” consent to the processing of their personal data, with significant penalties
for non-compliance.2 This requirement essentially mandates opt-in consent to data collection.
Evidence shows that opt-in results in much lower levels of participation than opt-out (Johnson
et al., 2002, 2020), which may explain why opt-out was a predominant way businesses obtained
consent before the GDPR.
Although the European Commission has been positive about the overall success of the
GDPR,3 the media’s assessment has been mixed. Positive assessment was based on moreuser control over personal data, transparency, and accountability requirements on data processors, while negative assessment pointed out the complexity and compliance costs, especiallyfor smaller businesses, adverse effects on investment in technology ventures, as well as the
GDPR’s insufficient data protection measures.4
The academic literature has been generally more critical. A number of empirical studies
report adverse effects of the GDPR on businesses such as a decrease in the amount of datacollected (Schmitt et al., 2021; Congiu et al., 2022; Aridor et al., 2023) which adversely affect
AI startups and data-based innovation (Bessen et al., 2020; Batikas et al., 2023), dampened
incentives to invest in technology ventures (Jia et al., 2021), a decrease in the number of mobile
apps (Janßen et al., 2022), reduced website pageviews and e-commerce revenue (Goldberg et al.,2024), and increased market concentration in websites and web technology services (Schmitt
et al., 2021; Peukert et al., 2022; Johnson et al., 2023).5 In addition, several theoretical studies
1
Following the GDPR, many countries enacted similar privacy laws or amended existing ones in line with the
GDPR. Examples include the California Consumer Privacy Act (CCPA) and Brazil’s General Data Protection
Law (LGPD) both of which came into effect in 2020, Singapore’s Personal Data Protection Act (PDPA) amended
in 2019, and South Korea’s Personal Information Protection Act (PIPA) amended in 2020, etc.
2
Some of the largest non-compliance penalties are 746 million euros Luxembourg’s privacy watchdog (CNPD)
imposed on Amazon in 2021, 150 million euros on Google levied by France’s privacy watchdog (CNIL) in 2022
and, more recently, 390 million euros Ireland’s Data Protection Commission imposed on Meta in 2023.
3
https://ec.europa.eu/commission/presscorner/detail/en/qanda 20 1166
4
See, for example, “America should borrow from Europe’s data-privacy law,” The Economist, April 5, 2018;“One year on, GDPR needs a reality check,” Financial Times; June 30, 2019, “How GDPR is failing,” Wired,
May 23, 2022.
5
As potential beneficial effects of the GDPR, Godinho de Matos and Adjerid (2022) provide experimental

2

show that the GDPR’s opt-in requirement in its current form can be ineffective in allowing
consumers to effectively manage their privacy (Choi et al., 2019; Chen, 2022; Chaudhury andChoe, 2023).
Given the negative assessment summarized above, one may wonder if there is any salutary
effect to the GDPR. After all, if consumers are able to manage their privacy more effectively
thanks to the GDPR, shouldn’t they benefit from it? Or would the potential consumer benefits
be skimmed away by the digital business with market power? How does the GDPR change
total surplus? Answering these questions is the primary purpose of this paper.
We examine the GDPR’s opt-in requirement for data collection in an environment that
we believe incorporates consumer heterogeneity in a richer and more realistic way than in theexisting literature on digital privacy.6 Specifically, we assume that consumers differ in two dimensions, in their preference for the online service under consideration and in the privacy costs
incurred while sharing personal data with the online business. Adding consumer heterogeneity
in privacy costs to otherwise a standard model of privacy regulation is motivated by two factors. First, growing evidence reports that consumers are highly heterogeneous in their privacy
preferences (e.g., Goldfarb and Tucker, 2012; Ghose, 2017; Lin, 2022; Macha et al., 2024). For
example, Acquisti et al. (2015) review studies that classify individuals into three privacy groups:
privacy fundamentalists, pragmatists, and unconcerned. Second, given that one of the statedpurposes of the GDPR is to enable consumers to better manage their privacy, a model where
all consumers have identical privacy preference is unlikely to yield meaningful insight. Incorporating such multidimensional consumer heterogeneity allows us to study consumer choice in a
way that is richer than in the existing literature, which allows us to identify conditions underwhich the GDPR can increase or decrease welfare.
We briefly sketch our model. A firm sells an online service to consumers who are heterogeneous along two dimensions, valuation for the service and privacy cost, the latter incurred if a
consumer shares her personal data with the firm when using the service. If a consumer shares
her data with the firm, which we call opt-in as opposed to opt-out, she can enjoy additional
opt-in benefits offered by the firm. The firm can monetize the data, so that it earns revenue
from two sources: sales of its service that depends on the total demand the firm faces andshared consumer data that depends only on the opt-in demand. We call the former usage-based
revenue and the latter data-based revenue. The firm chooses price for its service to maximize
profit, and consumers make decisions to buy the firm’s service and whether or not to share datawith the firm. We compare the equilibria before and after the GDPR.
Our basic assumption is that the GDPR enables consumers to proactively manage theirdigital privacy by requiring the firm to allow consumers to buy its service without sharing theirpersonal data, i.e., opt-out purchase. That is, before the GDPR, consumers must share datawith the firm when buying its service but, after the GDPR, consumers can choose between opt-in
and opt-out purchase. This is clearly a simplifying assumption. Even before the GDPR, some
privacy-conscious consumers may bypass the firm’s data collection, for example, by deletingcookies, using VPNs or privacy-oriented browsers, etc. Likewise, even after the GDPR, someevidence that suggests that the GDPR’s enhanced opt-in requirements may improve welfare by providing better
privacy protection to consumers and allowing firms to better target their marketing communications.
6This literature is reviewed in Section 2.

3

consumers may routinely opt in without thinking through the ramifications of their decisions.
However, insofar as more consumers rationally make opt-in decisions after the GDPR, which we
believe is plausible, our main insight should continue to hold.7 In short, a key change brought
about by the GDPR in our model is privacy management made available to consumers, whomake opt-in decisions by comparing benefits from sharing data with possible privacy costs.8
First, we show that the equilibrium price for the firm’s service increases after the GDPR.
The intuition is as follows. Before the GDPR, some consumers with high privacy costs may not
buy the service because they do not have an option to buy the service without sharing personal
data. After the GDPR, they can participate by choosing opt-out purchase, which expands
demand for the service. This allows the firm to raise price. The additional choice of opt-out
purchase and the higher price will inevitably decrease the opt-in demand, hence the amount ofdata shared, which will erode the firm’s data-based revenue. But the effect of higher price on
data-based revenue is smaller after the GDPR because the firm earns data-based revenue only
from opt-in demand after the GDPR in contrast to total demand before the GDPR. That is, thefirm’s choice of price is less constrained by data-based revenue after the GDPR. This implies
that the firm charges a higher price for its service after the GDPR regardless of the size of its
data-based revenue.
Our next result shows how the GDPR changes the equilibrium demand for the firm’s service.
As discussed above, the GDPR expands demand by providing consumers with an additional
choice of opt-out purchase, which we call the demand expansion effect. But it leads to ahigher price for the service, which counteracts the demand expansion effect. If the demand
expansion effect dominates the price effect, then the equilibrium demand increases after the
GDPR; otherwise, it decreases. We show that the effect of the GDPR on the equilibrium
demand hinges on the firm’s revenue model. When the firm’s revenue is mainly from selling
service and its data-based revenue is not large, the firm chooses a high price for its service
close to the monopoly level. As a result, the market is not sufficiently covered before the
GDPR, which leaves significant room for demand expansion after the GDPR. In this case, thedemand expansion effect dominates the price effect, hence the equilibrium demand increases
after the GDPR. However, if the firm earns large data-based revenue, it chooses a low price forits service, resulting in the market sufficiently covered before the GDPR. In this case, the priceeffect dominates the demand expansion effect, implying that the demand increase following the
GDPR is limited. Moreover, if the price increase after the GDPR is sufficiently large, thenconsumers with high privacy costs who purchased the service before the GDPR drop out of themarket after the GDPR. As a result, the equilibrium demand can decrease after the GDPR.
Although the effect of the GDPR on the total equilibrium demand depends on the firm’s databased revenue, the amount of data collected by the firm unambiguously decreases after the7

For example, we can consider a model where a fraction of tech-savvy, privacy-conscious consumers make
optimal opt-in decisions, and the rest always opt in. We can think of the GDPR as increasing the fraction of thefirst group of consumers.
8
Another interpretation is that the GDPR allowed firms to credibly exercise second-degree price discrimination
by offering a menu of {(price for the service, no opt-in benefits), (price for the service, positive opt-in benefits)}.
For example, many German news websites offer free access to its content subject to advertising and tracking or a paid subscription without advertising and tracking.
Some examples arehttps://abo.spiegel.de/de/c/microsites/werbefreilesen/abo or https://www.faz.net/faz-net-services/.

4

GDPR, consistent with empirical evidence cited earlier.
Next, we show how the firm’s profit changes after the GDPR. As previously alluded to,the effect of the GDPR on profit also depends on the firm’s revenue model. When the firm’s
revenue is largely usage-based, the higher price and larger demand imply that the firm earns
larger revenue after the GDPR. Although its data-based revenue decreases because the quantityof shared data decreases, the firm earns larger profit because the data-based revenue is a smallpart of its profit. On the other hand, the GDPR can erode the firm’s profitability if its revenue islargely data-based because, in this case, the GDPR leads to limited demand expansion but has alarge negative effect on the quantity of data collected. The implication is that the GDPR’s effecton the firm’s profit depends on the firm’s business model. The GDPR is likely to benefit usagedriven businesses such as ride-hailing platforms like Uber or streaming services like Netflix, buthurt data-driven businesses such as various navigation and weather apps and, to some extent,
businesses whose main revenue source is advertising that leverages user data.
The GDPR’s effect on consumer surplus also hinges on whether the firm’s revenue is largely
usage-based or data-based. In the former case, the GDPR’s demand expansion effect dominates
the price effect. Given that more consumers can participate in the market after the GDPR
while benefiting from more effective privacy management, consumer surplus increases in thiscase. However, when the firm earns significant data-based revenue, the price effect dominates
the demand expansion effect, and the equilibrium demand can decrease. Thus consumer surplus
decreases in this case. Once again, the implication is that the GDPR can benefit consumers inmarkets that are largely service-based, but can hurt consumers when data-based revenue is asignificant part of digital business. Given that total surplus is the sum of profit and consumer
surplus, the GDPR’s effect on total surplus parallels its effect on profit and consumer surplus.
Namely, the GDPR is likely to improve welfare in usage-driven businesses but reduce welfare
in data-driven businesses.
Although the GDPR’s opt-in requirement is the main focus of this paper, the way wedescribe privacy management made available after the GDPR applies more generally to other
online businesses as well. In many e-retailers such as Target, Walmart, Zara, etc., consumers canchoose to create an account for transaction or check out as a guest without creating an account.
By creating an account, consumers share various personal data with the retailer. The benefits ofcreating an account include faster checkout, order tracking, and exclusive deals and promotions.
On the other hand, sharing data with e-retailers can pose privacy risks such as identity theft,
data breaches, cyberstalking, etc. The option to manage privacy is available in other platforms
such as Google and YouTube. Users can choose the incognito mode or delete usage history
after using services provided by these platforms. Once again, privacy management trades off
additional benefits from sharing data against possible privacy risks. The general conclusionfrom our analysis is that, for digital businesses that do not rely heavily on data-based revenue,
empowering consumers to proactively manage their digital privacy can improve firm profitability,
increase consumer surplus, and hence is welfare-improving. But effective privacy managementby consumers can reduce welfare when businesses rely heavily on data-based revenue.9 We
9Gopal et al. (2023) also derive a similar conclusion although welfare-reducing effect of privacy management
stems from increased third-party data sharing.

5

stress that this conclusion applies where consumers can effectively manage their privacy. But
this may not necessarily be the case even after the GDPR, as we discuss in Section 6.5.
The rest of the paper is organized as follows. In Section 2, we review the related literature.
Section 3 presents our baseline model. Section 4 analyzes the baseline model and Section 5
provides our key welfare results. In Section 6, we discuss several extensions and variationsof the baseline model, and provide the discussions on testable hypotheses and management
implications. Section 7 concludes the paper. The Appendix contains the analysis of a generalmodel that encompasses the baseline model studied in Sections 4 and 5. All missing proofs arerelegated to the Online Appendix.

2

Related Literature

Our work is related to a number of theoretical studies that model some of the key features of
the GDPR and examine the digital business’s optimal strategy and welfare implications. Choiet al. (2019) focus on the GDPR’s opt-in requirement when there are data externalities, andshow that the monopolistic firm can render opt-in regulations ineffective if it can exercise pricediscrimination. In deriving this result, they assume full market coverage, whereas we consider
the case where the firm uses uniform pricing and the market is not fully covered. Fainmesser
et al. (2023) study the digital business’s choice of data collection and data security, and show
how the optimal strategy depends on the digital business’s revenue model, i.e., whether it ismore usage-driven or data-driven. But the digital business’s optimal pricing decision is absent intheir model, nor do consumers explicitly make opt-in decisions. Ke and Sudhir (2023) analyze amodel of behavior-based pricing that endogenizes the consumer’s decision to exercise the rights
to opt-in, data erasure and data portability, and firms can offer personalized products to opt-in
consumers. In their model, data erasure and portability imply that only opt-in decisions arise
in equilibrium.10 Chen (2022) studies socially optimal data collection policy when consumers
differ in privacy costs. Chaudhury and Choe (2023) provide an illustrative example of optimaldata policy when consumers differ in privacy costs and there are multiple data types. Although
not directly related to the GDPR, Campbell et al. (2015) show that a consent requirement inprivacy regulation can tilt the playing field in favor of large generalist firms at the cost of small,
specialist firms, because it imposes a one-off cost on both but consumer data has multiple use in
the former. In addition to the differences already explained above, none of these studies models
multidimensional consumer heterogeneity as we do in this paper.
A large and growing body of literature studies consumers’ privacy choice and the attendantdata externalities (Choi et al., 2019; Ichihashi, 2021, 2023; Acemoglu et al., 2022; Bergemannet al., 2022, etc.).11 A general conclusion from these studies is that opt-in consumers allow thedata controller to infer more information about opt-out consumers, which can lead to excessive
data sharing and raise the cost from privacy breach.12 Once again, the main difference between
these studies and ours is that we explicitly model multidimensional consumer heterogeneity
10

Cong and Matsushima (2023) also consider data management by consumers in a two-dimensional Hotellingmodel where data collected in one market can be used in another market.
11
For a review of the literature on privacy, see Acquisti et al. (2016) or Acquisti (2023).
12
In addition, based on opt-in consumers’ data, sellers can infer preference of opt-out consumers, which can leadto higher prices and create negative pecuniary externalities (Belleflamme and Vergote, 2016; Braghieri, 2019).

6

whereas consumers differ only in one dimension in these studies, e.g., in their valuation of thedigital business’s service (Choi et al., 2019; Bergemann et al., 2022) or in their valuation ofprivacy (Acemoglu et al., 2022; Ichihashi, 2023).
Several studies model multidimensional consumer types as we do in this paper, although theirfocus is different from ours (Anderson and Gans, 2011; Jentzsch et al., 2013; Miklós-Thal et al.,2024). Anderson and Gans (2011) model consumer heterogeneity in preference and disutility
from advertising in the media market. In the oligopoly model of product differentiation in
Jentzsch et al. (2013), consumers differ in brand preference and transportation costs. MiklósThal et al. (2024) study consumers’ privacy choice when each consumer is represented by two
data types, privacy-sensitive data and innocuous data. Methodologically, the way we model
opt-out is close to the choice of ad avoidance in Anderson and Gans (2011). That is, consumers
in our model can choose opt-out purchase to avoid privacy costs although they lose the opt-in
benefits by doing so.

3

Model

We consider a digital business that provides an online service at zero marginal cost and charges
price p. Consumers are heterogeneous along two dimensions: valuation for the service (v) andprivacy cost (c). We interpret c to be the maximum possible privacy cost the consumer incurs
when sharing data with the firm.13 We assume v and c are independent and are uniformly
distributed on [0, 1]2 .14 Consumers face three possible choices: buying the service while sharing
data, called opt-in purchase; buying the service without sharing data, called opt-out purchase;and not buying the service.15 Denote the mass of consumers choosing opt-in purchase by DS ,the mass of consumers choosing opt-out purchase by DN , and the total demand for the firm’s
service by D = DS + DN .
The firm can further enhance its service by offering additional benefits to consumers whochoose opt-in purchase. We call this opt-in benefits denoted by x ∈ (0, 1).16 The opt-in benefits
include, among others, time saved thanks to faster checkout, exclusive deals and promotions,improved and personalized service, etc. To focus squarely on the GDPR’s effect on the demand
for the firm’s service, we assume x is exogenously given.17 Thus, the main strategic variable
the firm chooses in our model is price for its service.
We choose price as the firm’s strategic variable in order to present a model that can encompass usage-based and data-based digital businesses in a unified framework, which facilitates
the comparison of how the GDPR impacts these businesses. In reality, some data-driven busi13
In the baseline model, we assume the consumer expects her actual privacy cost to be equal to the maximum
possible privacy cost. In Section 6.2, we consider the case where the expected privacy cost is a fraction of the
maximum possible privacy cost with the fraction depending on the firm’s revenue model.
14
In Section 6.1, we discuss the case where v and c are correlated.
15
By opt-in purchase, we mean more than sharing data with the firm; it also allows the firm to share or selldata to third parties. Likewise, opt-out purchase prevents the firm from selling or sharing personal information
with third parties, as stipulated in the CCPA Section 120.
16
Given that the highest possible privacy cost is 1, we consider the nontrivial case where x < 1.
17
As an extension of the baseline model, we considered the case where x is chosen endogenously so that thefirm offers two versions of its service, p for opt-out consumers, and (p, x) for opt-in consumers. This does notchange our qualitative results relevant to the GDPR’s welfare effects, if the firm incurs one-off investment costin choosing x. The details are available upon request.

7

nesses, for example, in search and social media, provide “free” services in return for user data
they monetize, and they rely on additional strategic variables such as the investment in technology and innovation and various data monetization strategies. But the fact that they provide“free” service, hence a zero price, does not mean price does not play a role.18 A zero price canbe an optimal choice for businesses with significant data-based revenue. As the GDPR makes
data collection more difficult, many data-driven businesses depart from the zero price policy,
which further indicates the importance of price as a strategic variable for these businesses.19
A consumer of type (v, c) ∈ [0, 1]2 who chooses opt-in purchase receives utility
US (v, c) := v + (x − c) − p| {z }(1)

net opt-in
benefits

where p is the price charged by the firm and x − c is the opt-in benefits less privacy cost. If a
type-(v, c) consumer chooses opt-out purchase, then her utility is
UN (v, c) := v − p.

(2)

Clearly, the main difference between opt-in and opt-out purchase is that a consumer choosing
opt-in purchase expects the additional opt-in benefits as well as privacy costs. As discussed
in Section 1, a key change brought about by the GDPR is that firms need explicit opt-in
consent from consumers in order to collect data. Our interpretation of this in our model isthat consumers can choose between opt-in and opt-out purchase after the GDPR, although
they cannot choose opt-out purchase before the GDPR. Based on this, we can summarize
a consumer’s decision as follows. Before the GDPR, a consumer buys the firm’s service if
US ≥ 0. After the GDPR, she chooses opt-in purchase if US ≥ max{UN , 0}, opt-out purchase
if UN ≥ max{US , 0}, and no purchase otherwise.
The firm’s revenue comes from two sources. First, the firm earns revenue from sales of its
service. Given the total demand for the firm’s service D(·), its sales revenue is pD(·). Second, thefirm can monetize the data it collects, for example, through selling data for targeted advertising(Bergemann and Bonatti, 2015), using data for personalized pricing (Choe et al., 2018; Chenet al., 2020), or through product improvement by data-enabled learning (Hagiu and Wright,
2023). We do not model how the firm monetizes its data and simply assume that the revenue isexogenously given by α ≥ 0 per unit of consumer data. Given that the firm collects data fromall opt-in consumers whose mass is denoted by DS (·), the firm’s revenue from data is αDS (·).
Noting that we assume away all costs for the firm, the firm’s profit is given byΠ = pD(·) + αDS (·).
| {z } | {z }salesrevenue18(3)

data-based
revenueGans (2022) presents a model where a zero price can be an optimal choice by a monopolistic firm under theassumption of free disposal and the presence of a mass of nongeneric consumers. In our model, a zero price, oreven a negative price, can be an optimal choice for businesses if they earn significant data-based revenue. In bothcases, price is the relevant strategic variable whether it is zero or even negative.
19
As we discuss in Section 6.6, many online businesses with a data-based revenue model respond to privacy
regulations by exploring new revenue sources such as paid subscriptions or tiered services with differential pricing.
This indicates a prominent role price plays in these businesses.

8

Before the GDPR, we have DN = 0, hence D = DS . Therefore, the main difference in the firm’s
profit after the GDPR is the possibility that D > DS .
The game proceeds as follows. First, consumers learn their types privately. Next, the firmchooses p to maximize profit given in (3), which is followed by consumers’ decisions: before
the GDPR, consumers make only purchase decisions; after the GDPR, they make additional
data-sharing decisions.
In the remainder of this section, we offer discussions on our assumption that opt-out purchaseis not available before the GDPR. In case the firm is better off by offering both opt-in and optout purchase options to consumers, one may ask why it does not do so before the GDPR.
We argue that the lack of stringent enforcement before the GDPR implies that the firm could
not credibly commit not to gather data from consumers who choose opt-out purchase. As
explained earlier, privacy regulations in Europe before the GDPR were largely based on general
guidelines and principles, and enforcement mechanisms and penalties for non-compliance wereleft to the discretion of individual EU member states. Regarding the consent requirement fordata collection, some member states such as France and Germany required consent for dataprocessing, while others were not explicit about consent requirements. But even when the fine
was imposed for breach, it was substantially smaller than what was imposed after the GDPR.
For example, the French privacy watchdog (CNIL) imposed 150,000 euros on Google in 2014
for failing to provide clear and comprehensive information to users and for not obtaining theirconsent before storing cookies on their devices.20 This is in stark contrast to the significant
penalties introduced after the GDPR.21
Our argument can be formalized by considering a simple sequential-move game as follows.
In the first stage, the firm offers an opt-out purchase option in addition to an opt-in purchase
option. In the second stage, consumers make purchase decisions and decide which option tochoose. In the final stage, the firm decides whether or not to monetize data from consumers
who chose opt-out purchase. If monetizing data from opt-out consumers incurs an expectedpenalty smaller than the revenue from data monetization, then the firm chooses to monetize
data. Then, by backward induction, consumers do not choose opt-out purchase in the second
stage simply because the firm’s offer of opt-out purchase option is not credible. Consequently,
they face only two effective choices: opt-in purchase or no purchase. This is our interpretation of
the privacy regime before the GDPR. The main thrust of the GDPR is that it lends credibility
to the firm’s offer of opt-out purchase option thanks to its stricter enforcement and significant
penalties for infringement.
20

https://www.reuters.com/article/us-france-google-fine-idUSBREA0719U20140108/
The GDPR’s Art. 83(5) specifies that the fine for infringement can be up to 20 million euros or 4% of global
turnover of the preceding financial year, whichever is higher. For example, the Luxembourg National Commission
for Data Protection imposed 746 million euros on Amazon in 2021 for tracking user data without acquiring
appropriate consent or providing the means to opt out from tracking (https://www.politico.eu/article/amazonfined-e746m-for-violating-privacy-rules/).
21

9

4

Analysis

4.1

Equilibrium before the GDPR

Since consumers cannot choose opt-out purchase in this case, any consumer who buys the firm’s
service also shares her data with the firm. Thus, consumer utility relevant to her purchasedecision is US (v, c).
A consumer of type (v, c) buys the service if and only if
US (v, c) ≥ 0 =⇒ c ≤ c(v, p) := v + x − p.
In the above, c(v, p) is the privacy cost that makes the consumer indifferent between opt-in
purchase and no purchase given her valuation v and price p. Then, c(1, p) = 1 + x − p is
the threshold value of privacy cost above which there is no demand for the service. Likewise,v(p) := p − x is the threshold value of consumer valuation for the service, below which there isno demand for the service.
Depending on v(p) > 0 or v(p) ≤ 0, there are two possible cases, as shown in Figure 1. First,
the demand for the case where 0 < v(p) < 1, i.e., x < p < 1 + x, is illustrated in panel (a) in
Figure 1, which we call case 1a. This is the case where some consumers with low valuation forthe service do not purchase the service regardless of their privacy costs. This case arises when
the price is higher than the opt-in benefits. Second, panel (b) in Figure 1 shows the demand
for the case where −1 ≤ v(p) ≤ 0, or x − 1 ≤ p ≤ x, which we call case 1b.22 This is the casewhere the opt-in benefits are large enough (x ≥ p) so that all consumers with relatively low
privacy costs purchase the service, regardless of their valuation for the service. But the opt-in
benefits are not too large (x < 1 + p) so that some consumers with high privacy costs and low
valuation do not purchase the service. In case 1b, a subset of consumers along one dimensionof consumer types is fully served, but not along the other dimension. Thus, a case like this ispossible only when consumer types are multidimensional.
1

c

1

c

−v(p)

c(1, p)Opt-in0

Opt-in
1

v(p)

v

0

1 + v(p)1v(b) Case 1b: −1 ≤ v(p) ≤ 0(a) Case 1a: 0 < v(p) < 1

Figure 1: Demand before the GDPR
22

Note that the restriction x − 1 ≤ p allows the possibility that the firm may choose a negative price sincex < 1 by assumption. This may happen when the firm’s revenue is largely data-based, i.e., large α, in which casethe firm may subsidize consumers’ purchase of its service with a view to monetizing their data.

10

From the above, we can calculate the demand for the firm’s service as23
Z 1 Z c(v,bp)(1 + x − pb)2


dcdv
=


2
b p) = Zv(bp) 0 Z
D(b
Z 1
Z 1
1+v(b
p
)
c(v,b
p
)

(1 − x + pb)2


dcdv = 1 −dcdv +

2
1+v(b
p) 0
0
0

if x < pb < 1 + x,
(4)
if x − 1 ≤ pb ≤ x.

b p) = (bb p), leading to the following first-order condiThe firm chooses pb to maximize Π(bp + α)D(b
tion.
b p)
∂ Π(b
=
∂ pb

b p)
b p) + p ∂ D(b+D(b| {z }∂ pb|{z}
Margineffect(+)

Volume (−)
effect

b p)
∂ D(b
α
∂ pb
| {z }= 0.

Data Volume (−)
effectApart from the trade-off between classical margin and volume effects the firm faces in choosing
price, the presence of data-based revenue reduces the firm’s incentive to increase price. If α = 0,b pb < 0, the firm will set price lower
then we have the standard monopoly problem. Given ∂ D/∂
than the monopoly price when it earns data-based revenue.
We can solve the first-order condition for the equilibrium price pb⋆ .24 In equilibrium, theconditions for case 1a and case 1b can be restated in terms of α. Specifically, case 1a arises
for small values of α and case 1b, for large values of α. In the appendix, we show that case 1acorresponds to the range of α such that α < α1 (x) := max{(1−2x)/2, 0} and case 1b corresponds
to the range of α such that α ≥ α1 (x). Intuitively, when α is small, the firm chooses a high priceclose to the monopoly level, which leaves a large part of the market uncovered. As α increases,
the firm’s optimal price decreases, which in turn increases the equilibrium demand.
The analytical results can be complicated due to multidimensional consumer types. In orderto provide the key insight as clearly as we can, we report the results for the case x = 1/4 in themain text. As will become clear below, the case x = 1/4 admits all possible equilibria in ourmodel, which allows us to explain our main results at little loss of generality.25 This allows us
to express the equilibrium in terms of α only and discuss how the impact of the GDPR differs
depending on the firm’s revenue model, i.e., different values of α. We then calculate how theequilibrium changes as the value of α changes, based on which to explain our main results. In
the appendix, we provide the detailed analytical steps for all the results in the main text for
general values of x and α, showing that our results can be generalized. Therefore, we omit theproof of the results in Section 4.
When x = 1/4, the threshold value of α that divides case 1a and case 1b is given by α = 1/4,
which is shown in the appendix. Solving the firm’s problem for pb⋆ , and deriving the equilibriumb ⋆ , profit Πb ⋆ , and consumer surplus CSd⋆ , we obtain the following.
demand D
Lemma 1 When x = 1/4, the equilibrium before the GDPR can be characterized as follows.
23

We use b to indicate the regime before the GDPR and e for the regime after the GDPR.
The first-order condition is also sufficient. That is, we can show that the solution to the first-order conditionb within the relevant range corresponding to case 1a and case 1b.
pb⋆ is the unique extreme value that maximizes Π
The details are provided in the online appendix.
25
As shown in the appendix, both case 1a and 1b equilibria are possible √before the GDPR when x ≤ 1/2, andboth case 2a and 2b equilibria are possible after the GDPR when x ≤ 2 − 2 ≈ 0.585.
24

11

• If α < 1/4, then we have case 1a where the equilibrium price, demand, profit, and consumer
surplus are given as
1b⋆ = 2pb = (5 − 8α), D
12
9
⋆



5
+α
4

2

b⋆ = 2
, Π
27



5
+α
4

3

d⋆ = 4
, CS
81



5
+α
4

3
.

• If α ≥ 1/4, then we have case 1b where the equilibrium price, demand, profit, and consumer
surplus are given as


2 
 !

3
3
3
1
⋆
b =
− −α+β , D
6− α−
+ α−
β ,
2
9
4
4

2 
 !


1
3
3
3
⋆
b =
Π
2α − + β
β ,
6− α−
+ α−
27
2
4
4



3

2 ! !
⋆
3
3
3
1
d =
81 + 18 α −−2 α−− 2 12 − α −
β ,
CS
81
4
4
4
1
pb =
3
⋆

where β =p
6 + (α − 3/4)2 .

It is easy to check from the above lemma that the equilibrium price decreases in α but theequilibrium demand, profit and consumer surplus all increase in α. This is intuitively clear.
When α increases, the firm can benefit more by increasing the volume of data, from which it
earns data-based revenue. Thus, it reduces price to attract more consumers. A lower priceand larger demand imply that consumer surplus increases in α. In addition, since the firm’s
equilibrium profit changes in response to a change in α exactly by the amount of its equilibrium
demand, a direct consequence of the envelope theorem, the firm’s profit also increases in α.
Finally, we note that the equilibrium price can be negative when α is large enough. Nonetheless,the equilibrium profit increases in α thanks to larger data-based revenue.
α

Case

Price

DemandProfitConsumer surplus

Total surplus

0
0.1
0.2
0.25
0.4
0.5
0.958
2.5
3.5
4.5

1a
1a
1a
1b
1b
1b
1b
1b
1b
1b

0.417
0.350
0.283
0.250
0.191
0.154
0
-0.330-0.439-0.507

0.347
0.405
0.467
0.500
0.557
0.591
0.719
0.912
0.952
0.970

0.145
0.182
0.226
0.250
0.329
0.387
0.689
1.979
2.913
3.875

0.096
0.122
0.151
0.167
0.198
0.219
0.320
0.592
0.694
0.759

0.241
0.304
0.376
0.417
0.527
0.606
1.009
2.571
3.607
4.634

Table 1: Equilibrium outcome before the GDPR
Table 1 shows how the equilibrium price, demand, profit and consumer surplus change when
α increases. For α ≤ 0.25, we have case 1a equilibrium outcomes and, for α > 0.25, we havecase 1b equilibrium outcomes, which is indicated in the second column. As shown in the table,
the equilibrium price decreases in α but the equilibrium demand, profit and consumer surplus
all increase in α. The equilibrium price is equal to zero when α = 0.958 and becomes negative12

thereafter. This confirms our earlier explanation that, when the firm earns large data-based
revenue, it can be optimal to pay consumers to use its service and monetize data thus collected.26

4.2

Equilibrium after the GDPR

After the GDPR, a consumer of type (v, c) chooses opt-in purchase if US ≥ max{UN , 0}, opt-out
purchase if UN ≥ max{US , 0}, and no purchase if max{US , UN } ≤ 0. Thus, the set of consumers
choosing opt-in purchase is given by{(v, c) ∈ [0, 1]2 | c ≤ v + x − p, x ≥ c},and the set of consumers choosing opt-out purchase is given by{(v, c) ∈ [0, 1]2 | v ≥ p, x < c}.
As before, US ≥ 0 leads to the threshold condition, c ≤ c(v, p) = v+x−p. Then, v(p) = p−x
is the threshold value of consumer valuation for the service, below which no consumers choose
opt-in purchase. Next, UN ≥ 0 if v ≥ p, which leads to vN (p) := p, the threshold valueof consumer valuation, below which no consumers choose opt-out purchase. Clearly, we havev(p) ≤ vN (p). In addition, US ≥ UN holds if and only if x ≥ c.
1

c

1

c
Opt-outOpt-outxx

Opt-in0v(p)vN (p)

1

Opt-in−v(p)v

0 vN (p)1v(b) Case 2b: −x < v(p) ≤ 0(a) Case 2a: 0 < v(p) < 1

Figure 2: Demand after the GDPR
Once again, we have two possible cases, depending on v(p) > 0 or v(p) ≤ 0. These are
depicted in Figure 2, where the area labeled opt-in represents the demand from consumers
who choose opt-in purchase and the area labeled opt-out is the demand from consumers whochoose opt-out purchase. Panel (a) illustrates the demand for case 2a where 0 < v(p) < 1,
i.e., x < p < 1 + x, and panel (b) shows the demand for case 2b where −x ≤ v(p) ≤ 0, i.e.,0 ≤ p ≤ x.27 As expected, the additional opt-out purchase made available by the GDPR allows
consumers to self-select themselves: those with low privacy costs choose opt-in purchase in order26

For example, Nielsen Mobile App pays users redeemable reward points for using its app and, in return,collects data by tracking users’ phone usage.
27
Unlike the case before the GDPR, the firm will always choose a non-negative price after the GDPR. It isbecause consumers with v ≥ p and c > x choose opt-out purchase, implying that p = 0 leads to the market to be
fully covered: consumers with c < x choose opt-out purchase and the rest of consumers choose opt-in purchase.
Thus, choosing a negative price cannot increase demand further.

13

to enjoy the opt-in benefits; those with high privacy costs choose opt-out purchase to avoid theprivacy costs.
In addition to the two cases in Figure 2, there is another case with vN (p) = p > 1, when
there is no opt-out demand.28 From the above, we can calculate the opt-in, opt-out, and total
demands as follows. First, the opt-in demand isZ 1 Z c(v,ep)(1 + x − pe)2


dcdv
=



2

v(e
p) 0


Z 1 Z xZ vN (ep) Z c(v,ep)x2
e S (eDp) =dcdv +
dcdv =+ x(1 − pe)

2
v(e
p
)
0
v
(e
p
)
0

N
Z

Z 1 Z xvN (ep) Z c(v,e
p)

pe2


dcdv = x −
dcdv
+

2
vN (e
p) 0
0
0

if 1 < pe < 1 + x,
if x < pe ≤ 1,

(5)

if 0 ≤ pe ≤ x.

The opt-out demand is zero when 1 < pe < 1 + x. In the other two cases, the expression for the
opt-out demand is the same in both cases and is given by
Z 1

Z 1

e N (e
D
p) :=
vN (e
p)

x

dcdv = (1 − x)(1 − pe).

(6)

The total demand is then2 (1 + x − pe)




 2 2
x
e p) = De S (ee N (eD(ep) + Dp) =+ 1 − pe

2




pe2

1 − (1 − x)ep−2

if 1 < pe < 1 + x,
if x < pe ≤ 1,

(7)

if 0 ≤ pe ≤ x.

e p) = peD(ee p) + α D
e S (e
The firm chooses pe to maximize Π(ep). Compared to the problem before
the GDPR, the firm’s profit comes from two different sources. Its revenue from sales depends
on the total demand but the data-based revenue depends only on the opt-in demand. As before,
we can restate the conditions for case 2a and case 2b in terms of α in equilibrium. Consistent
with the case before the GDPR, case 2a arises for small values of α and case 2b, for large
values of α. In the appendix, we show that case 2a corresponds to the range of α such thatα < α2 (x) := max{(2 − 4x + x2 )/(2x), 0} and case 2b corresponds to the range of α such thatα ≥ α2 (x). Moreover, one can verify that α1 (x) ≤ α2 (x) for all x ∈ (0, 1), which implies that
there are three possible pairs of pre- and post-GDPR equilibria for any α: (case 1a, case 2a) if
α < α1 (x); (case 1b, case 2a) if α ∈ [α1 (x), α2 (x)); (case 1b, case 2a) if α ≥ α2 (x).
In comparing the equilibria before and after the GDPR, we continue to focus on the casewhere x = 1/4. Then, the value of α that divides cases 2a and 2b is given by α = 17/8, which isshown in the appendix. Solving the firm’s problem for pe⋆ , and deriving the equilibrium demandse⋆ , De ⋆ , profit Πe ⋆ , and consumer surplus CSg⋆ , we obtain the following.
DS

N

Lemma 2 When x = 1/4, the equilibrium after the GDPR can be characterized as follows.
• If α < 17/8, then we have case 2a where the equilibrium price, demands, profit, and28

It is easy to see that this case does not arise in equilibrium because profit decreases in p when p > 1.

14

consumer surplus are given as




39
3
31
1
α
α
1
⋆
⋆
e =
e =
, D
,
(33 − 8α) , D
+
+
pe =
N
S
64
16 16
2
16 16
2




⋆
1 1089 39α α21 3319 99α 3α2
⋆
e
g
Π =
, CS =.
++++
16 25616
4
96 25616
4⋆• If α ≥ 17/8, then we have case 2b where the equilibrium price, demands, profit, andconsumer surplus are given as






1
3
1 9
⋆
e S⋆ = Γ 3 + 2α − 1 (α2 + 3α + 3), D
eN
Γ−α−
, D
=
+α−Γ ,
3
2
18
9
4 2


2

e ⋆ = Γ α2 + 3α + 33 − α − α − 3 , CSg⋆ = 17 + δ −216 + 27δ + 4δ 2 ,
Π
27
4
3
12 4
32 648pe⋆ =where Γ =p
6 + (α + 3/2)2 and δ = Γ − α − 3/2.

The comparative statics of the equilibrium is similar to that for the case before the GDPR. It
is easy to check from the above that the equilibrium price is decreasing in α but the equilibrium
opt-in and opt-out demands, profit and consumer surplus are all increasing in α. To facilitate thecomparison with the case before the GDPR, we provide Table 2 where we show the equilibriumoutcomes after the GDPR for various values of α. We have case 2a equilibrium when α < 17/8 =2.215, and case 2b equilibrium when α ≥ 2.215, which is indicated in the second column. As
shown in the table, the equilibrium price decreases in α but the equilibrium demands, profit andconsumer surplus all increase in α. In addition, the equilibrium price is always non-negative
after the GDPR, as explained earlier.
α

Case

Price

Opt-in demand

Opt-out demand

ProfitConsumer surplus

Total surplus

0
0.1
0.2
0.25
0.4
0.5
2.215
2.5
3.5
4.5

2a
2a
2a
2a
2a
2a
2b
2b
2b
2b

0.516
0.503
0.491
0.484
0.466
0.453
0.245
0.230
0.189
0.160

0.152
0.155
0.159
0.160
0.165
0.168
0.220
0.224
0.232
0.237

0.363
0.373
0.382
0.387
0.401
0.410
0.566
0.577
0.608
0.630

0.266
0.281
0.297
0.305
0.329
0.346
0.680
0.743
0.971
1.206

0.135
0.142
0.148
0.152
0.162
0.169
0.311
0.322
0.356
0.381

0.401
0.423
0.445
0.457
0.491
0.515
0.990
1.065
1.327
1.587

Table 2: Equilibrium outcome after the GDPR

5

Comparing the Equilibria before and after the GDPR

This section compares the equilibria before and after the GDPR and discusses the welfare
implications of the GDPR. Our discussions are based on the results from the previous section,i.e., the case where x = 1/4. But the qualitative results hold for general values of x, which isshown in the appendix. Thus, we omit the formal proof of the results in this section.

15

The preceding analysis shows that, before the GDPR, we have case 1a equilibrium if α < 1/4
and case 1b equilibrium if α ≥ 1/4. After the GDPR, we have case 2a equilibrium if α ≤ 17/8
and case 2b equilibrium if α > 17/8. Thus, we can identify three pairs of equilibria as follows:(i) if α < 1/4, then we have case 1a equilibrium before the GDPR and case 2a equilibrium after
the GDPR; (ii) if 1/4 ≤ α ≤ 17/8, then we have case 1b equilibrium before the GDPR and case2a equilibrium after the GDPR; (iii) if 17/8 < α, then we have case 1b equilibrium before the
GDPR and case 2b equilibrium after the GDPR. This is shown in Figure 3, where the verticaldashed line corresponds to x = 1/4, the case where the results in Sections 4 and 5 are from.
α1 (x)α2 (x)

Data-based revenue (α)

43(1b, 2b)2
1
0(1b, 2a)0(1a, 2a)
0.2

0.4
0.6
0.8
Opt-in benefits (x)1Figure 3: Different pairs of equilibria
Our first result is that the equilibrium price increases after the GDPR. It is because the
GDPR enables consumers to better manage their privacy, which leads to a larger demand. To
see this more closely, suppose a consumer of type (v, c) does not purchase the service before the
GDPR when the price is p. This implies v + x < p + c. After the GDPR, the consumer canchoose opt-out purchase if v ≥ p. On the other hand, a consumer who buys the service before
the GDPR will continue to do so at the same price after the GDPR; the only difference is that
she will choose opt-out purchase if v + x > p + c but x < c. Put together, we can conclude that,at any given price, the firm faces a weakly larger demand after the GDPR. This allows the firm
to raise price. A higher price can erode the firm’s data-based revenue by reducing the amountof data shared. But the effect is smaller after the GDPR because the firm earns data-based
revenue only from the opt-in demand after the GDPR whereas its data-based revenue is fromthe total demand before the GDPR. Consequently, the firm is less constrained by data-based
revenue after the GDPR. Thus, it charges a higher price after the GDPR irrespective of the sizeof its data-based revenue.
Proposition 1 The equilibrium price is higher after the GDPR, i.e., ∆p⋆ = pe⋆ − pb⋆ > 0.
In Table 3, we compare the equilibrium prices for various values of α. These prices canbe found in Tables 1 and 2. As noted above, the comparison is between case 1a equilibrium
and case 2a equilibrium if α < 1/4, which is shown in the first three rows in Table 3. If
1/4 ≤ α < 17/8 = 2.215, then the comparison is between case 1b equilibrium and case 2a16

equilibrium, which is shown in the next two rows. In the rest of Table 3, the comparison is
between case 1b equilibrium and case 2b equilibrium because α ≥ 17/8. As shown in the table,
the equilibrium price is always higher after the GDPR.
α

Equilibrium pair

Price before the GDPR

Price after the GDPR

0
0.1
0.2
0.25
0.4
0.5
2.5
3.5
4.5

(case 1a, case 2a)(case 1a, case 2a)(case 1a, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2b)(case 1b, case 2b)(case 1b, case 2b)

0.417
0.350
0.283
0.250
0.191
0.154
-0.330-0.439-0.507

0.516
0.503
0.491
0.484
0.466
0.453
0.230
0.189
0.160

Table 3: Comparison of equilibrium prices
Our next result shows how the GDPR changes the equilibrium demand. Other things equal,
the GDPR should expand demand because, as explained above, it provides consumers with anadditional choice of opt-out purchase. We call this the demand expansion effect. But the priceincrease following the GDPR as shown in Proposition 1 acts as a countervailing force, which wecall the price effect. Since the pre-GDPR equilibrium price decreases in α, the price effect can belarge when α is large. If the price effect more than offsets the demand expansion effect, then the
GDPR can reduce the equilibrium demand; otherwise, it will increase the equilibrium demand.
When α is small, say α < 1/4, we have case 1a equilibrium before the GDPR and case 2aequilibrium after the GDPR. This is the case where the market is not sufficiently covered before
the GDPR. Thus, there is significant room for demand expansion. Consequently, the demand
expansion effect dominates the price effect, implying that the equilibrium demand increases
after the GDPR. When α is large, however, the market is sufficiently covered before the GDPR,
hence there is not much room for demand expansion. In addition, large α implies a large priceeffect. In this case, we expect the price effect to dominate the demand expansion effect and,accordingly, the equilibrium demand decreases after the GDPR.
Although the effect of the GDPR on the total equilibrium demand hinges on α, the effect of
the GDPR on the amount of data shared is unambiguously negative. That is, the equilibrium
opt-in demand after the GDPR is always smaller than the total equilibrium demand before the
GDPR. The intuition is clear. Given the additional choice of opt-out purchase made available
after the GDPR, some consumers with high privacy costs who purchased the service before
the GDPR can switch to opt-out purchase after the GDPR. This implies that, even when the
GDPR increases the total equilibrium demand, we expect the demand from consumers whochoose opt-in purchase to be smaller than that before the GDPR. As discussed previously, thenegative effect of the GDPR on the amount of data collected is well documented. We also notethat the marginal consumer with the lowest privacy cost who shares data has a higher valuation
for the service after the GDPR, i.e., ve⋆ > vb⋆ . This follows directly from Proposition 1 sinceve⋆ = pe⋆ − x > pb⋆ − x = vb⋆ . This is more or less consistent with the empirical findings in Aridor
et al. (2023) that, although the GDPR has resulted in a reduction in total cookies, the consumers

17

who continue to be tracked after the GDPR tend to be more valuable to advertisers.29
Proposition 2 Comparing the equilibria before and after the GDPR, we find the following.
• There is a threshold value α1 ∈ [1/4, 17/8] such that the total demand is larger after thee⋆ + De⋆ ) − Db⋆ ≥ 0GDPR if α ≤ α1 but smaller after the GDPR if α ≥ α1 , i.e., ∆D⋆ = (DS

N

if and only if α ≤ α1 .
• For all α, the opt-in demand after the GDPR is smaller than the total demand before theb⋆ > De⋆ .
GDPR, i.e., D
S• For all α, the marginal consumer with lowest privacy cost who shares data has a higher
valuation for the service after the GDPR, i.e., ve⋆ > vb⋆ .
In Table 4, we compare the equilibrium demands for various values of α based on Tables 1
and 2. The total demand is larger after the GDPR for all α that leads to case 1a equilibrium
before the GDPR and case 2a equilibrium after the GDPR. But it is smaller for all α that leads
to case 2b equilibrium after the GDPR. Although not shown in the table, the threshold value
at which ∆D⋆ = 0 is given by α1 ≈ 0.438. We also note that, for all values of α, the opt-in
demand after the GDPR is smaller than the total demand before the GDPR.
α

Equilibrium pair

Before the GDPR
Total demand

Opt-in demand

After the GDPR
Opt-out demand

Total demand

0
0.1
0.2
0.25
0.4
0.5
2.5
3.5
4.5

(case 1a, case 2a)(case 1a, case 2a)(case 1a, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2b)(case 1b, case 2b)(case 1b, case 2b)

0.347
0.405
0.467
0.500
0.557
0.591
0.912
0.952
0.970

0.152
0.155
0.159
0.160
0.165
0.168
0.224
0.232
0.237

0.363
0.373
0.382
0.387
0.401
0.410
0.577
0.608
0.630

0.516
0.528
0.541
0.547
0.566
0.578
0.801
0.840
0.867

Table 4: Comparison of equilibrium demands
Next, we discuss the GDPR’s impact on the firm’s profit. If α is small so that the firm’s
revenue does not depend significantly on data, then the GDPR benefits the firm. This can beseen from Propositions 1 and 2: when α < 1/4, both the equilibrium price and demand increase
after the GDPR, hence so does the profit. As α becomes large, however, the price increase after
the GDPR can be countered by the decrease in total demand after the GDPR, as discussed in
Proposition 2, which can eventually make the firm worse off after the GDPR. Simply put, when
the firm’s revenue depends heavily on data, the GDPR has a limited demand expansion effectand, moreover, can lead to a large loss in the amount of data collected as consumers switch to
opt-out purchase.
29

Godinho de Matos and Adjerid (2022) report experimental evidence that suggests an alternative channel
that the GDPR can generate benefits to advertisers. That is, the GDPR can lead to varying amounts of datacollected from different types of data, which can help improve targeting capabilities by advertisers.

18

Proposition 3 There is a threshold value α2 ∈ [1/4, 17/8] such that the equilibrium profit ise ⋆ −Πb⋆ ≥ 0larger after the GDPR if α ≤ α2 but smaller after the GDPR if α ≥ α2 , i.e., ∆Π⋆ = Π
if and only if α ≤ α2 .
In Table 5, we compare the equilibrium profits for various values of α. As shown in thetable, the equilibrium profit is larger after the GDPR for all α that leads to case 1a equilibrium
before the GDPR and case 2a equilibrium after the GDPR, but smaller for all α that leads tocase 2b equilibrium after the GDPR. The threshold value at which ∆Π⋆ = 0 is α2 ≈ 0.399.
αEquilibrium pairProfit before the GDPR

Profit after the GDPR

0
0.1
0.2
0.25
0.4
0.5
2.5
3.5
4.5

(case 1a, case 2a)(case 1a, case 2a)(case 1a, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2b)(case 1b, case 2b)(case 1b, case 2b)

0.145
0.182
0.226
0.250
0.329
0.387
1.979
2.913
3.875

0.266
0.281
0.297
0.305
0.329
0.346
0.743
0.971
1.206

Table 5: Comparison of equilibrium profits
An implication of Proposition 3 is that the GDPR can benefit digital businesses that earnrevenue primarily from selling services, of which the main channel is demand expansion thanks
to more effective privacy management. Examples of such usage-driven businesses include ridehailing platforms such as Uber, Lyft, streaming services such as Netflix, Spotify, and, to someextent, online market places such as Amazon and eBay. But the GDPR can hurt digital businesses whose revenue is in large part based on data. Such data-driven businesses include various
navigation and weather apps and, to some extent, Google and Facebook whose main revenue
source is advertising that leverages user data. For these firms, the GDPR’s demand expansion
effect is limited but loss of data collected following the GDPR can be significant.
In view of the above result that the GDPR has a negative impact on profits when α is large,
the firm can respond to the GDPR by switching its revenue model from a more data-based one(larger α) to a less data-based one (smaller α). This is supported by a recent work by Cheyre
et al. (2023). They study how app developers on the Apple App Store responded to Apple’s
App Tracking Transparency (ATT) framework introduced in June 2020. To the extent that
ATT limits collection and sharing of user data, its impact on app developers is comparable
to the impact of the GDPR. Following the introduction of ATT, they find that app developers
reduced the use of software development kits (SDKs) that rely on data-intensive advertising but
increased the use of SDKs related to authorization and payment services. This can be viewed
as an example of switching the revenue model mentioned above.
Then, how does consumer surplus change after the GDPR? As discussed previously, consumers with low privacy costs are likely to be worse off because of the higher price after the
GDPR, but those with high privacy costs are likely to be better off thanks to better privacy
management. In particular, all consumers with c < x are worse off either because they dropout of the market or because they pay a higher price after the GDPR. On balance, the GDPR
is more likely to increase consumer surplus when α is smaller for the following reasons. First,
19when α is small, the equilibrium price before the GDPR is already close to the monopoly level
and, therefore, the price increase following the GDPR is limited. Second, as explained earlier,there is significant room for demand expansion when α is small. Thus, the GDPR’s demand
expansion effect is more likely to dominate the price effect for smaller values of α, which increases consumer surplus. As α increases, however, the price effect together with the reduced
demand expansion effect imply that the GDPR can decrease consumer surplus. Once again, theimplication is that the GDPR can benefit consumers in markets that are largely service-based,
but it can hurt consumers when data-based revenue is a significant part of digital business.
Combining the above discussions and Proposition 3, we can conclude that the GDPR’s effecton total surplus is also similar to that on profit and consumer surplus, since total surplus is thesum of profit and consumer surplus. That is, the GDPR can increase total surplus at low valuesof α, but it can decrease it when α is large. Thus, the GDPR’s welfare-improving effect is more
likely in usage-driven businesses while its welfare-reducing effect is more likely in data-driven
businesses.
Proposition 4 Comparing the equilibria before and after the GDPR, we find the following.
• There is a threshold value α3 such that the equilibrium consumer surplus is larger afterg⋆ − CSd⋆ ≥ 0the GDPR if α ≤ α3 but smaller after the GDPR if α ≥ α3 , i.e., ∆CS ⋆ = CS
if and only if α ≤ α3 .
• There is a threshold value α4 such that the equilibrium total surplus is larger after the⋆⋆
GDPR if α ≤ α4 but smaller after the GDPR if α ≥ α4 , i.e., ∆T S ⋆ = TfS − TcS ≥ 0 if
and only if α ≤ α4 .
In Table 6, we compare the consumer surplus and total surplus for various values of α. The
consumer surplus is larger after the GDPR when α < 0.2 but smaller when α ≥ 0.2. The
threshold value at which ∆CS ⋆ = 0 can be calculated as α3 ≈ 0.190. Note that this thresholdvalue is smaller than the threshold value for the GDPR’s positive effect on profit, the latterbeing α2 ≈ 0.399. This implies that the threshold value for the GDPR’s positive effect on total
surplus is between α1 and α3 . As shown in Table 6, the total surplus is larger after the GDPR
when α < 0.4 but smaller when α ≥ 0.4. Although not shown in the table, the threshold value
at which ∆T S ⋆ = 0 can be calculated as α4 ≈ 0.333.
αEquilibrium pair

Before the GDPR
Consumer surplus

Total surplus

After the GDPR
Consumer surplus

Total surplus

0
0.1
0.2
0.25
0.4
0.5
2.5
3.5
4.5

(case 1a, case 2a)(case 1a, case 2a)(case 1a, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2a)(case 1b, case 2b)(case 1b, case 2b)(case 1b, case 2b)

0.096
0.122
0.152
0.167
0.198
0.219
0.592
0.694
0.759

0.241
0.304
0.376
0.417
0.527
0.606
2.571
3.607
4.634

0.135
0.142
0.148
0.152
0.162
0.169
0.322
0.356
0.381

0.401
0.423
0.445
0.457
0.491
0.515
1.065
1.327
1.587

Table 6: Comparison of consumer surpluses and total surpluses20

We can explain the main mechanism behind the welfare impact of the GDPR with help of
Figure 4, where vb⋆ = pb⋆ − x and bc⋆ = 1 + x − pb⋆ correspond to the equilibrium before the GDPR,⋆ = p
and ve⋆ = pe⋆ − x and veNe⋆ correspond to the equilibrium after the GDPR. Since pe⋆ > pb⋆ as⋆ . In Figure 4, four regions are labeled (I) - (IV)shown in Proposition 1, we have vb⋆ < ve⋆ < veN

to indicate four groups of consumers choosing different behavior before and after the GDPR.
1

c

1

c
(II)

(II)
b
c⋆

x − pb⋆

(IV)
(I)

(IV)
x

x
(I)
⋆

0 vb

⋆

ve

(III)
⋆
veN

1

(III)

x − pe⋆v0(a) Case 1a, Case 2a

⋆
veN

1

v

(b) Case 1b, Case 2b(I) Consumers who drop out of the market after the GDPR;(II) Consumers who join the market through opt-out purchase after the GDPR;(III) Consumers who choose opt-in purchase both before and after the GDPR;(IV) Consumers who switch from opt-in purchase to opt-out purchase after the GDPR

Figure 4: Comparison of equilibrium demands
Panel (a) in Figure 4 illustrates the case where α is relatively small, hence the comparison is
between case 1a equilibrium before the GDPR and case 2a equilibrium after the GDPR. Before
the GDPR, the total equilibrium demand is represented by the triangle made up of (I), (III),and (IV). After the GDPR, the opt-out demand is the sum of areas (II) and (IV), and the opt-in⋆ , x), (1, 0) and (1, x).
demand is given by the trapezoid defined by the coordinates (ev ⋆ , 0), (evN

Thus, the total demand after the GDPR is the sum of areas (II), (III), and (IV).
These changes in demand can be explained by considering the behavior of four groups ofconsumers. The first group is consumers in area (I), who drop out of the market after the GDPR
because the firm raises its price after the GDPR. They have relatively low valuations for theservice and low privacy costs. Thus, the additional opt-out choice made available by the GDPR
does not have much value for them. The second group is consumers in area (II), who buy theservice only after the GDPR. They have relatively high valuations and high privacy costs. Due
to high privacy costs, they do not buy the service before the GDPR but, after the GDPR, theychoose opt-out purchase. The third group is consumers in area (III), who buy the service underboth privacy regimes and share data as they have relatively low privacy costs (c ≤ x). The
fourth group is consumers in area (IV), who buy the service under both privacy regimes but
choose opt-out purchase after the GDPR due to relatively high privacy costs (c > x). Thus the
GDPR creates winners and losers. The first and third groups of consumers are worse off after
the GDPR. The second group of consumers is better off while the welfare change for the fourthgroup depends on the trade-off between the higher price and better privacy management.
In panel (b) of Figure 4, we consider the case where α is relatively large so that the comparison is between case 1b equilibrium before the GDPR and case 2b equilibrium after the21GDPR. As before, the total equilibrium demand is the sum of areas (I), (III), and (IV) before
the GDPR, and the sum of areas (II), (III), and (IV) after the GDPR. This is the case where
the market is sufficiently covered before the GDPR so that there is quite a small new demand
created after the GDPR, i.e., the area (II). But the price increase after the GDPR is sufficiently
high so that consumers with high privacy costs and low valuations who purchased the service
before the GDPR drop out of the market after the GDPR, i.e., the area (I).30
The general insight from the above discussions can be summarized with help of Table 7,
where consumers are grouped based on (v, c). The mass of consumers in each group is endogenous, as it depends on the equilibrium prices before and after the GDPR. The second column
shows their choice before and after the GDPR and the last column shows the change in consumer surplus for each group, as explained above. For small values of α, i.e., panel (a) of Figure
4, the pre-GDPR price is high, which implies that there is a large mass of consumers in groupII, and their gains in consumer surplus outweigh the decrease in consumer surplus for groups I
and III. Given the higher price and larger demand, profit also increases after the GDPR. Thisimplies that total surplus increases after the GDPR when α is small. For large values of α, panel(b) of Figure 4, the pre-GDPR price is low, implying that the mass of consumers in group II issmall while those of other groups are significantly larger. Given that there are more consumers
who lose after the GDPR (groups I and III) than those who gain (group II), total consumer
surplus decreases after the GDPR. In addition, since a large mass of consumers in group I dropout of the market due to the price increase following the GDPR, profit also decreases after the
GDPR. Put together, we can conclude that total surplus decreases when α is large.
Consumer types

Choice before and after the GDPR

∆CS

Group I: (low to intermediate c, low v)
Group II: (high c, high v)
Group III: (low c, low to high v)
Group IV: (intermediate c, high v)

opt-in purchase → no purchaseno purchase → opt-out purchase
opt-in purchase → opt-in purchase
opt-in purchase → opt-out purchase

(–)
(+)
(–)
(?)

Table 7: Consumers’ choice before and after the GDPR

6

Discussions and Extensions

6.1

Correlation between v and c

Our baseline model assumed that v and c are independent. Depending on digital services, it isconceivable that there could be some correlations between the two. Take social media services,for example. A consumer who actively uses social media services may do so because she does
not perceive the privacy cost to be high, which suggests a negative correlation between v andc.31 The correlation can be positive in medical services and health apps. These services often
require users to share sensitive health data and, therefore, privacy-conscious individuals would30

The remaining case is for intermediate values of α where the comparison is between case 1b equilibrium
before the GDPR and case 2a equilibrium after the GDPR. We omit the discussions for brevity, as our main
focus is on the two polar cases explained above.
31
A study by Pew Research Center (2019) suggests that individuals who are less concerned about privacy are
more likely to share more personal information on social media.

22choose to share such information as they value these services highly. In this section, we allow
correlations between v and c. In particular, we examine two polar cases of perfect positive andperfect negative correlations. The insight from these two cases may be used for extrapolation
in intermediate cases.
□ Positive correlation. Suppose c = ϕv where ϕ ∈ (0, 1), and assume x < ϕ so that there
is a positive mass of consumers who opt out after the GDPR, i.e., consumers with x < c = ϕv,
or v > ve := x/ϕ. In this case, the GDPR’s demand expansion effect does not exist. The reason
is that, given the perfect positive correlation, consumers who do not buy the service before
the GDPR do not buy the service either after the GDPR. To see this, let vb be the marginal
consumer who buys the service before the GDPR, i.e., vb + (x − ϕbv ) − p = 0 and [bv , 1] is the total
demand before the GDPR. After the GDPR, the positive correlation between v and c implies
that consumers on [bv , ve] continue to choose opt-in purchase while those on [ev , 1] choose opt-out
purchase. In addition, by the definition of ve and the fact that ve > vb, no consumers outside [bv , 1]
participate in the market through opt-out purchase.
Consequently, the GDPR does not boost demand; it only divides the pre-GDPR total demand into opt-in and opt-out demands. As a result, the equilibrium price does not change
after the GDPR. Given that the equilibrium price and total demand do not change, the firm isworse off after the GDPR. It is because the firm earns data-based revenue only from the opt-in
demand after the GDPR, which is smaller than the total demand because consumers on [ev , 1]
choose opt-out purchase after the GDPR. Finally, consumer surplus increases after the GDPR
because the price stays the same while those choosing opt-out purchase benefit from privacy
management. To summarize, the GDPR can hurt the firm and benefit consumers when v andc are positively correlated. It is worth noting that these results hold regardless of α.
□ Negative correlation. Suppose now c = 1 − ϕv where we set ϕ = 1 to simplify analysis.
Then, there is a positive mass of consumers who opt out after the GDPR because x > 0. Let
ve = 1 − x be the marginal consumer, who is indifferent between opt-in purchase and opt-out
purchase if ve ≥ p. Then, for all v < ve, we have c = 1 − v > 1 − ve = x. It follows that all
consumers on [p, ve] choose opt-out purchase. That is, the negative correlation between v andc implies that consumers who choose opt-out purchase are those with lower valuations, hence
higher privacy costs, than ve, which is in contrast to the case with positive correlation. Thisimplies that the GDPR can expand demand by inducing participation by consumers with low
valuations who would not have opted in before the GDPR. More specifically, since consumers
with low valuations choose opt-out purchase, the total demand after the GDPR is given by
D(p) = 1 − p, which is independent of x. On the other hand, the demand before the GDPR
increases in x. Thus, the GDPR’s demand expansion effect depends on x: the GDPR is more
likely to expand demand when x is smaller and decrease it when x is larger. To summarize,
when v and c are negatively correlated, the GDPR’s welfare effects depend on x and α, in
contrast to the case with positive correlation.
Proposition 5 Suppose v and c have a perfect positive correlation given by c = ϕv, ϕ > x,
ϕ ∈ (0, 1) and assume α < 1 + x − ϕ which ensures that the equilibrium price is positive. Then,comparing the equilibria before and after the GDPR,
23

• the price and demand are the same;• the firm’s profit is smaller but the consumer surplus is larger after the GDPR.
Suppose v and c have a perfect negative correlation given by c = 1 − v and assume α < 1 + x
which ensures that the equilibrium price is positive. Then, comparing the equilibria before andafter the GDPR,• the price is higher after the GDPR if and only if α > x;
• the total demand is larger after the GDPR if and only if α < 1 − x;
• there are threshold values αL and αH with αL < αH such that the profit is larger after the
GDPR if and only if max{0, αL } < α < min{αH , 1 + x};• there is a threshold value αCS such that the consumer surplus is larger after the GDPR if
and only if α < min{αCS , 1 + x}.
Proof: See the online appendix.

6.2

When the expected privacy cost increases in α

Our baseline model assumed that a type-(v, c) consumer incurs the privacy cost c when sharing
data with the firm independent of α, i.e., the firm’s revenue model. Our interpretation is thatc represents the consumer’s maximum possible privacy cost, which the consumer expects to beequal to her actual privacy cost. We now consider an alternative scenario in which the consumer
expects her actual privacy cost to vary depending on the firm’s revenue model. Specifically, we
assume that the expected privacy cost is a fraction of the maximum privacy cost with the fraction
increasing in α.32 For example, the larger α is, the more data the firm collects, which may leadto larger expected costs from privacy breach. Although our model does not allow different
amounts of data that can be collected by the firm, we nonetheless consider the possibility thatthe expected privacy cost is higher when the firm’s business model is more data-driven.
Suppose a type-(v, c) consumer’s expected privacy cost is given by f (α)c where f is anincreasing function of α. We assume f (0) > 0 so that the expected privacy cost from data
sharing is positive even if the firm’s business model is purely usage-driven.33 We also assume f
is bounded above by 1 because the expected privacy cost cannot exceed the maximum possible
privacy cost. Given this, a type-(v, c) consumer’s utility from opt-in purchase at price p changes
from US (v, c) = v + x − c − p to US (v, c) = v + x − f (α)c − p. The rest of the baseline model
remains the same.
In the following, we consider the case where f is given by f (α) = k + (1 − k)α for somek ≤ 1, and focus on the case with x = 1/4 and α ∈ [0, 1].34 We restrict the value of k such
32

We thank an anonymous reviewer for suggesting this extension.
For example, the business model of financial institutions is predominantly service-based although some banks
may monetize customer data by selling them to third parties. Nevertheless, there are multiple incidents of highprofile data breaches at banks, exposing customers to significant privacy risks. See, for example, “The biggest
data leaks and how to prevent them from repeating,” Forbes, October 23, 2023.
34
Focusing on the case α ∈ [0, 1] is at no loss of our main insight. In all the figures that accompany our general
results provided in the appendix, we consider the case where α ≤ 1. In addition, in all the results presented inTable 4-6, the critical threshold values of α are less than 1. We do not expect our main insight to change forother functional forms for f insofar as f is an increasing function of α bounded above by 1.
33

24

that f (α)c > x. This is to rule out the trivial case where all consumers choose opt-in purchase,in which case the GDPR does not have any impact. Since f (α) = 1 when k = 1, our baselinemodel corresponds to the case where k = 1. Thus, when k = 1, our results that the GDPR
decreases the equilibrium profit and consumer surplus stay the same. For all other values ofk < 1, we have f (α) < 1, hence the expected privacy cost f (α)c is less than c. In addition, f (α)cdecreases as k decreases, which implies that the benefits of GDPR decrease because there is lessvalue in privacy management when the expected privacy cost is lower. Thus, as k decreases,
we expect the threshold values of α at which the GDPR increases profit or consumer surplus tobecome smaller.
To verify the above, we solve the model for the equilibria before and after the GDPR when
US (v, c) = v + x − (k + (1 − k)α)c − p, calculate the equilibrium profits and consumer surpluses,and find the relevant threshold values of α. The results are shown in Table 8 with full analysis
provided in the online appendix. In the second column, we calculate the threshold values of α ate⋆ −Πb ⋆ = 0, as discussed
which the GDPR’s effect on the equilibrium profit is zero, i.e., ∆Π⋆ = Π
in Proposition 3. The GDPR increases the equilibrium profit if and only if α is below thisthreshold, as in our baseline model. The third column shows the threshold values of α at whichg⋆ − CSd⋆ = 0,the GDPR’s effect on the equilibrium consumer surplus is zero, i.e., ∆CS ⋆ = CS
as discussed in Proposition 4. The GDPR increases the equilibrium consumer surplus if andonly if α is below this threshold, as in our baseline model.
kValue of α when ∆Π⋆ = 0

Value of α when ∆CS ⋆ = 0

0.4
0.5
0.6
0.7
0.8
0.9
1.0

0.128
0.190
0.243
0.288
0.329
0.366
0.399

0.053
0.083
0.108
0.128
0.144
0.155
0.191

Table 8: When the expected privacy cost increases in α
The main difference between the results in this section and our baseline model is that therelevant threshold values of α are smaller than those in the baseline model and they decrease as
k decreases, as shown in Table 8. Thus, a positive relation between α and the expected privacy
costs dampens the welfare effects of the GDPR. This is not surprising in that our baselinemodel assumed that consumers expect the actual privacy costs to be equal to the maximum
possible privacy costs, hence the GDPR’s privacy management has more benefits than what
was considered in this section. Nonetheless, our main insight continues to hold that the GDPR
can be welfare-improving for small values of α but can reduce welfare for large values of α.

6.3

Data externalities

A consumer’s data-sharing decision can impose several types of externalities on others. First,
consumers using the firm’s service may enjoy network benefits that increase as more consumers
share data with the firm (Hagiu and Wright, 2023). For example, online retailers such as
Amazon and Etsy rely on various user-generated data including product reviews and ratings25

to provide valuable information to consumers. Network benefits may also include improved
products and services that sellers on the marketplaces can provide based on customer feedback.
Second, data sharing by some consumers can impose negative externalities in the form of larger
privacy costs on others who do not share data (Choi et al., 2019; Ichihashi, 2021; Bergemannet al., 2022; Miklós-Thal et al., 2024). For example, some people’s shared data can be used toinfer information about others who do not share data. As more data is shared, the inference canbe improved through machine learning, which leads to larger privacy costs. As another example,
hackers can use personal data obtained from one group of users to craft convincing phishingemails or other social engineering attacks targeted at another group of users. Third, there canbe negative pecuniary externalities whereby the firm can use the data on opt-in consumers toinfer information on and charge higher price to opt-out consumers (Belleflamme and Vergote,
2016; Braghieri, 2019). In this section, we consider the first two, positive network benefits andnegative data externalities, and discuss how our main results may change.
□ Positive network benefits. As discussed above, we consider positive network benefits that
increases in the mass of opt-in consumers. Denote network benefits by θDS where θ ≥ 0 is an
exogenously given value accruing from an additional opt-in consumer. We assume that network
benefits are enjoyed by all consumers who buy the service whether or not they share data withthe firm. For example, even if a consumer makes a purchase at an online shop without creating
an account, she can still read all the reviews and ratings. Thus, the main difference between
opt-in and opt-out purchase is that a consumer choosing opt-in purchase expects additional
opt-in benefits as well as privacy costs, which is the same as in the baseline model.
When there are network benefits, a consumer’s opt-in decision depends on her expectationon the mass of opt-in consumers, which we denote by DSe . Then, a consumer of type (v, c)derives expected utilityU := v + (x − c) + θDSe − p, S
U (v, c, DSe ) = UN := v + θDSe − p,
U := 0,Owith opt-in purchase,with opt-out purchase,
without purchase.

As is clear from the above, consumers are more likely to purchase the service because bothUS − UO and UN − UO increase by θDSe compared to the case without network benefits. But
network benefits do not affect their opt-in decisions since US − UN is the same with or without
network benefits. Given that the GDPR’s main effect in our model is to allow consumers tomake opt-in decisions proactively, we expect our key insight from the baseline model to remainunchanged.
□ Negative data externalities. Suppose negative data externalities are proportionate to theconsumer’s privacy cost and the expected mass of opt-in consumers, DSe . Let γ ≥ 0 represent themagnitude of negative externalities, so that consumer (v, c) suffers total negative externalities
equal to γcDSe . We can consider two possible ways negative externalities can be introduced tothe baseline model. First, suppose negative externalities affect all consumers including those
who share data, as in Choi et al. (2019). In this case, all consumers’ utility decreases by γcDSe ,whether they choose opt-in purchase, opt-out purchase, or no purchase. Consequently, the26

analysis is exactly the same as before.
Suppose now that negative externalities affect consumers who do not share data, whether
or not they buy the service. Then, consumer (v, c) derives utilityU := v + (x − c) − p, S
U (v, c, DSe ) = UN := v − γcDSe − p,
U := −γcDe ,OSwith opt-in purchase,with opt-out purchase,
without purchase.

As is clear from the above, negative externalities make opt-in a more attractive choice than
opt-out: compared to the baseline model, US − UN increases by γcDSe . In addition, US − UO
also increases by γcDSe but UN − UO stays the same. Put together, we can conclude thatnegative externalities increase the proportion of consumers who choose opt-in purchase. Thisdiminishes the value of an option to choose opt-out purchase, which dampens the effect of the
GDPR. But our key insight does not change because the main mechanism that the GDPR cancreate more demand remains intact even in the presence of negative externalities. That is, theGDPR allows consumers with large privacy costs who stay out of the market before the GDPR
to participate in the market through opt-out purchase; negative externalities reduce, but noteliminate, the proportion of such consumers. In addition, by making opt-in a more attractive
choice than opt-out, negative externalities also reduce the proportion of consumers who exit themarket after the GDPR because of the high price.

6.4

When consumers differ only in valuations of the service

One of our key results is how the GDPR leads to a substitution between data quantity and thee⋆ < Db ⋆ but ve⋆ > vb⋆ . This result depends
value of data as summarized in Proposition 2, i.e., DS

crucially on consumer heterogeneity in privacy costs. To verify this claim, we briefly discuss
the case without consumer heterogeneity in privacy costs. Suppose c is constant and denotez := x − c so that consumer type is represented by v only.
Before the GDPR, consumer v buys the service if v ≥ p − z, hence D = 1 − (p − z).
b ⋆ = (1 + z + α)/2. After the GDPR,
Maximizing Π = (p + α)D gives us pb⋆ = (1 + z − α)/2 and D
we have two cases. First, if z ≥ 0, then there is only opt-in purchase, implying that the outcome
is the same as that before the GDPR. In this case, the GDPR has no effect on the amount ofdata shared. Second, if z < 0, then there is only opt-out purchase. Then D = DN = 1 − p ande ⋆ = 1/2 and De ⋆ = 0.
DS = 0. Maximizing Π = pD + αDS leads to pe⋆ = D
SComparing the above and noting that z < 0 in this case, we find pe⋆ > pb⋆ always holds ande⋆ > Db ⋆ if and only if α + z < 0. That is, the equilibrium price increases after the GDPR, andD
the equilibrium demand increases if and only if α < c − x. It is also straightforward to checkthat the equilibrium profit increases after the GDPR if and only if α < c − x. But the quantityof shared data either does not change or decreases to zero. Thus, there is no possibility that the
GDPR reduces the quantity of data while increasing the marginal consumer’s valuation for thefirm’s service. This is intuitively clear since, in the absence consumer heterogeneity in privacy
costs, there is no sense in which the GDPR can invite consumers with high privacy costs tochoose opt-out purchase.

27

6.5

Testable hypotheses

In this section, we summarize testable hypotheses that can be derived from our analysis anddiscuss the issues relevant to testing these hypotheses.
Our main hypotheses can be summarized as follows. First, for digital businesses whose main
revenue source is selling service, empowering consumers to make informed and proactive decisions for data sharing can increase price for the service, consumer activity, business profitability,
and consumer surplus. Second, for digital businesses whose main revenue source is data which iscollected through selling service, more effective privacy management by consumers can increaseprice for the service, but decrease consumer activity, business profitability, and consumer surplus. As discussed earlier, the examples of usage-driven businesses include various ride-hailing
platforms and streaming services and, to some extent, online market places, while data-driven
businesses include various navigation and weather apps and, to some extent, digital platforms
whose main revenue source is advertising that leverages user data.
There is an important caveat in testing the above hypotheses. Our model assumes fullyinformed consumers who can rationally choose between opt-in and opt-out purchase after the
introduction of new privacy regulations, the GDPR being the focus of our paper. However, one
may argue that, even after the GDPR, consumers’ ability to manage privacy may be hampered
for various reasons. First, the GDPR’s cookie rules are not refined enough, which has led
to a proliferation of diverse consent management platforms and failed to enable consumers
to effectively manage their privacy (Chen, 2022; Chaudhury and Choe, 2023). Second, many
websites continue to rely on dark patterns, implied consent, and various forms of nudging to
influence consumers’ data sharing decisions (Utz et al., 2019; Machuletz and Böhme, 2020; Matteet al., 2020; Nouwens et al., 2020). Third, consumers generally show apathy toward complex
and long privacy notices and select the ‘quick join’ clickwrap to gain access to a website (Obarand Oeldorf-Hirsch, 2020).
In view of the above issues, the GDPR’s welfare implications analyzed in this study need
to be understood to apply to an environment where the GDPR achieves its stated purpose of
enabling consumers to make an informed and unambiguous consent to data sharing. However,identifying GDPR-compliant consent management platforms that are quarantined from theabove compounding factors can be challenging. It can also lead to a selection bias. Therefore,
our hypotheses may be best tested in carefully designed experiments.

6.6

Implications for management

Our analysis generates at least three clear implications for management relevant to digitalbusinesses with some market power. First, empowering customers in privacy management canbenefit the business that does not rely heavily on data-based revenue. As we have shown,active privacy management can expand demand as privacy-conscious consumers can choose
from multiple options to buy the service. This allows the business to raise price if it has somemarket power. The implication is that, even in jurisdictions without the GDPR-type opt-in
requirements, businesses may consider proactively empowering customers in privacy management. After all, today’s savvy consumers can, with a little research, find the information theyneed to make informed decisions. Providing them upfront with clear information and available
28

options can also minimize potential backlash and reduce customer churn.
Second, we have identified potential conflicts between the usage-based revenue and databased revenue. As the size of data-based revenue grows, the business has an incentive tolower price to attract more consumers and hence more data. This can erode the usage-based
revenue. One possible way to manage such conflicts is to separate the two revenue sources
into independent businesses. For example, a firm that provides advertising services can have aseparate entity responsible for collecting and monetizing user data. Of course, this is subject
to usual considerations relevant to corporate restructuring.35 The establishment of Alphabet
in 2015 may be understood in this context. Alphabet was formed as a holding company thatoversees several separate businesses including Google. This separation allowed Google to focus
on its core search and advertising business while giving other Alphabet subsidiaries such as
Life Sciences and Calico greater autonomy to pursue their own initiatives.36 Another example
involves Twitter and Gnip, an independent social media API aggregation company. Twitter
had a data licensing agreement with Gnip in 2010 for selling access to Twitter’s data to othercompanies. This allowed Twitter to focus on its core business of providing a social media
platform while giving Gnip the freedom to focus on monetizing Twitter’s data.37
Finally, our analysis suggests how online businesses with data-based revenue model can
respond to privacy regulations such as the GDPR in order to blunt the negative impact of theregulation. The key takeaway is that they need to reduce the reliance on data as the main
revenue source and explore into other revenue sources such as paid subscriptions. We havealready mentioned Cheyre et al. (2023) that shows how app developers responded to Apple’s
ATT by reducing the use of SDKs that rely on advertising and increasing the use of SDKs related
to payment services. Other examples include Meta and X (formerly Twitter). Facebook andInstagram (owned by Meta) launched a paid subscription service in 2023 in a bid to remove ads
from the platforms.38 X has also introduced a three-tiered paid premium subscription service
to expand its revenue sources.39

7Conclusion

This paper has studied the GDPR’s opt-in requirement in a simple model with a monopolistic
firm and consumers who differ in both valuations of the firm’s service and privacy costs. The
firm’s revenue comes from two sources: sales of its service which we call usage-based revenue,
and monetization of data which we call data-based revenue. Our basic assumption is that
consumers can choose to buy the service without sharing data, called opt-out purchase, only
after the GDPR. Relaxing this assumption will not alter our main insight, as long as moreconsumers proactively manage their privacy after the GDPR, the latter supported by various
empirical and experimental studies.
We have shown that the GDPR expands demand for the firm’s service by inviting consumers
35

Management accounting can also play a crucial role by developing performance measures based on which toprovide incentives to each revenue center in a way that can mitigate such conflicts.
36
See a blog post by Larry Page, Google’s co-founder, https://blog.google/alphabet/google-alphabet/.
37
Twitter eventually acquired by Gnip in 2014 to expand its own data analytics capabilities.
38
https://www.bbc.com/news/technology-67226394
39
https://help.twitter.com/en/using-x/x-premium

29with high privacy costs to participate in the market through opt-out purchase. This allows thefirm to raise price for its service. If the firm’s revenue is largely usage-based, then the equilibrium
demand also increases despite the higher price. In this case, the firm benefits from the GDPR
thanks to the higher price and larger demand. Consumer surplus also increases mainly due tothe increased consumer participation in the market through privacy management. On the other
hand, some consumers with high privacy costs and high valuations who bought the service
before the GDPR can switch to opt-out purchase after the GDPR. This leads to a smaller
quantity of shared data, which erodes the firm’s data-based revenue. Thus, the firm’s profit candecrease after the GDPR if its revenue is largely data-based. Moreover, the higher price after
the GDPR can lead some consumers with low valuations to drop out of the market after the
GDPR, decreasing consumer surplus as a result. Put together, we conclude that the GDPR
has differing effects on the firm and consumers, depending on the firm’s revenue structure. For
the firm without significant data-based revenue, the GDPR can increase profits and consumer
surplus, and hence can be welfare-improving. But it can decrease welfare when data-based
revenue is significant for the firm.
While the main focus of our paper has been on the GDPR, our model can be applied more
broadly to situations where consumers differ in their privacy preferences. Such heterogeneity
may motivate firms to cater to different groups of consumers by offering different versions of
their services, the simplest example being a binary choice between opt-in and opt-out purchasestudied in this paper. Although the current paper has not provided general analysis of such aversioning strategy, the analytical framework for this is similar to that used in the studies on ad
avoidance (Anderson and Gans, 2011; Lin, 2020; Amaldoss et al., 2024). In these studies, firms
offer different versions of digital content depending on the amount of ads consumers are exposed
to when consuming the content. Such an offer is credible because consumers can directly verify
their exposure to ads. In contrast, the credibility of an offer of opt-out choice in our paper needs
a commitment device such as the GDPR because consumers cannot tell whether their data areshared unless the cost of data breach is realized. We leave the study of versioning strategies
given consumers’ heterogeneous privacy preferences for future research.40

Appendix
This appendix presents analysis of the model for general values of x and α. Missing proofs are
all relegated to an online appendix. The results presented in Section 4 and 5 can be reproducedby substituting x = 1/4 into the results provided below.
40

Our preliminary work in this direction shows nuanced effects of versioning on market outcomes, dependingon the underlying market structure. When versioning can be offered credibly, the monopolistic firm is always
better off but competing firms are generally worse off.

30

Equilibrium before the GDPRb p) = (bb p) where D(bb p) is given in (I.1). Solving the
The firm chooses pb to maximize Π(bp + α)D(bfirst-order condition for pb, we obtain41
 1 + x − 2α


3
⋆
p
pb =

2(x
−
1) − α + 6 + (x + α − 1)2
3

if x < pb⋆ < 1 + x,
if x − 1 < pb⋆ ≤ x.

In the first case, one can verify that pb⋆ > x if and only if α < α1 (x) and pb⋆ < 1 + x always
holds where
α1 (x) := max
1 − 2x, 0 .
2

In the second case, we have pb⋆ ≤ x if and only if α ≥ α1 (x) and pb⋆ > x − 1 always holds. In
addition, given α ≥ 0, both cases are possible if (1 − 2x)/2 ≥ 0 or x ≤ 1/2; otherwise, only case
1b is possible.
Substituting pb⋆ into the demand, we obtain the equilibrium price and demand as
1 + x − 2α 2(1 + x + α)2,
if α < α1 (x),

3
9
⋆ b⋆

(b
p , D )= 2(x − 1) − α + β 6 − (x + α − 1)2 + β(x + α − 1),if α ≥ α1 (x),39pb ⋆ = (bb ⋆ (bwhere β := 6 + (x + α − 1)2 . The corresponding profit is Πp⋆ + α)Dp⋆ ), and consumer⋆d is given bysurplus is CS
Z 1 Z c(v,bp⋆ )US (v, c)dcdv


⋆ ⋆
v(b
p⋆ ) 0dCS (bp ) = Z 1+v(bp⋆ ) Z c(v,bp⋆ )
Z 1



US (v, c)dcdv +

0

1+v(b
p⋆ )

0

if α < α1 (x),Z 1
US (v, c)dcdv

if α ≥ α1 (x).

0Thus we have3b ⋆1a = 2(1 + x + α)Πif α < α1 (x),
27
b⋆ =
Π
2

Π
b ⋆ = (2(x + α − 1) + β)(6 − (x + α − 1) + β(x + α − 1)) if α ≥ α1 (x).
1b
27

3
⋆

4(1
+
x
+
α)

d1a =

if α < α1 (x),
CS

81

⋆
d = d⋆
81 + 18(x + α − 1) − 2(x + α − 1)3 − 2β(12 − (x + α − 1)2 )
CS
CS
=

1b

81




if α ≥ α1 (x).
The following lemma provides the comparative statics of the above equilibrium outcome.
Lemma A1
• The equilibrium price increases in the opt-in benefits x and decreases in the marginal
41

The online appendix provides the full details of solving the firm’s problem.

31

data-based revenue α.
• The equilibrium demand, profit, and consumer surplus are all increasing in x and α.
When x = 1/4 as assumed in the main text, we have α1 (x) = 1/4. Then, Lemma 1 in themain text is obtained by substituting x = 1/4 into the above expressions.

Equilibrium after the GDPRe p) = pe(De S (ee N (ee S (ee S (ee N (e
The firm chooses pe to maximize Π(ep) + Dp)) + αDp) where Dp) and Dp)
are as given in (I.2) and (I.2). Solving the firm’s problem, we obtain pe⋆ = (2 − 2αx + x2 )/4 ifp
x < pe⋆ < 1 + x and pe⋆ = (Γ − 2 − α + 2x)/3 if x − 1 < pe⋆ ≤ x where Γ := 6 + (2 − 2x + α)2 .
In the first case, one can verify that pe⋆ < 1 + x always holds and pe⋆ > x if and only if α < α2 (x)whereα2 (x) := max


2 − 4x + x2
, 0 .
2x

In the second case, we have pe⋆ ≤ x if and only if α ≥ α2 (x) and pb⋆ > x − 1 always holds. Also,√
given α ≥ 0, both cases are possible if (2 − 4x + x2 )/(2x) ≥ 0 or x ≤ 2 − 2 ≈ 0.585; otherwise,
only case 2b is possible. Put together, we can write the equilibrium price after the GDPR as422(1 − αx) + x2


4
pe⋆ =

 Γ − (2 − 2x + α)
3if α < α2 (x),if α ≥ α2 (x).

Substituting pe⋆ into the opt-in demand, we obtain
x 2 + 2αx + 2x − x24e S⋆ =
D3+(2− 2x + α)2 − Γ(2 − 2x + α)

x −
9

if α < α2 (x),if α ≥ α2 (x).

Similarly, the opt-out and total demands can be calculated as(1 − x)(2 + 2αx − x2 ) 2 + 2αx + x2,
if α < α2 (x),

4
4
⋆ e⋆
e

(DN , D ) = (1 − x)(5 + α − 2x − Γ) 6 − (2 + α − 2x − Γ)(x + α − 1),if α ≥ α2 (x).
39e ⋆ and consumer surplus CSg⋆ are given byThen, the firm’s profit Π

2
2


e ⋆ = 4 + 4x(x + 2α + 2αx) + x (x − 2α) ,Π
if α < α2 (x),

2a


16


−27(2 − αx) + 36(1 + 2x − α) − 9(1 + 2x − α)2 + (1 + 2x − α)3e⋆ = e⋆
Π
Π
=
2b


27



Γ(15
−
(5
−
2x
+
α)(1
+
2x − α))+if α ≥ α2 (x),2742

The online appendix provides the full details of solving the firm’s problem.

32

g⋆ =
CS


2 2
3
4


g⋆ = 12 + 24αx + 12(1 + α )x + 4(4 + 3α)x − 9x
CS
2a


96




if α < α2 (x),
2
2
2
2


g⋆ = δ(δ − 9xδ + 27x ) − 9(10 − 4x + 3x + 2α)δ + 27(5 + 3x )

CS

2b

162




if α ≥ α (x),2where δ := Γ − (2 − 2x + α).
The following lemma provides the comparative statics of the above equilibrium outcome.
Lemma A2
• The equilibrium price decreases in x if and only if α2 (x) > α ≥ x. The equilibrium pricedecreases in α.
• Both the equilibrium opt-in demand and total demand increase in x and α. The equilibrium2

opt-out demand increases in x if and only if α2 (x) > α > α3 (x) := 2+2x−3x
2−4x , and always
increases in α.
• Both the equilibrium profit and consumer surplus increase in x and α.
When x = 1/4, we have α2 (x) = 17/8. Then, Lemma 2 in the main text is obtained bysubstituting x = 1/4 into the above expressions.

Comparing the equilibria before and after the GDPR
Our analysis in the previous section shows that different equilibria exist for different values of(x, α). Before the GDPR, we have case 1a equilibrium if α ≤ α1 (x) and case 1b equilibrium
if α > α1 (x) where α1 (x) is given in (7). Since α ≥ 0, case 1a equilibrium exists only if
x ≤ 1/2 because α1 (x) = 0 if x > 1/2. This implies that case 1a equilibrium exists for(x, α) ∈ {(x, α)|α ≤ α1 (x), x ≤ 1/2}, and case 1b equilibrium exists for (x, α) ∈ {(x, α)|α >α1 (x), x ≤ 1/2} or (x, α) ∈ {(x, α)|α > α1 (x), x > 1/2}. Applying a similar argument to thecase after the GDPR, we can conclude that case 2a equilibrium exists for (x, α) ∈ {(x, α)|α ≤√α2 (x), x ≤ 2 − 2} and case 2b equilibrium exists for (x, α) ∈ {(x, α)|α > α2 (x)} where α2 (x)is given in (7). In addition, we can verify α2 (x) ≥ α1 (x), which implies that we cannot have case1a equilibrium before the GDPR co-existing with case 2b equilibrium after the GDPR. Basedon these discussions, we can identify a pair of equilibria corresponding to all possible values of(x, α), which we summarize below.
Lemma A3 A pair of equilibria before and after the GDPR can be fully described as follows:• If x ≤ 1/2 and α < α1 (x), then we have case 1a equilibrium before the GDPR and case2a equilibrium after the GDPR.
• If x ≤ 2 −√2 and α1 (x) ≤ α < α2 (x), then we have case 1b equilibrium before the GDPR

and case 2a equilibrium after the GDPR.

33

• If x ≤ 1 and α ≥ α2 (x), then we have case 1b equilibrium before the GDPR and case 2b
equilibrium after the GDPR.
Proof: From the preceding discussions, we can identify three possible pairs of equilibria as
follows. First, if x ≤ 1/2, then we have (case 1a equilibrium, case 2a equilibrium) if α <α1 (x) ≤ α2 (x), (case 1b equilibrium, case 2a equilibrium) if α1 (x) ≤ α < α2 (x), and (case 1b√
equilibrium, case 2b equilibrium) if α1 (x) ≤ α2 (x) ≤ α. Second, if 1/2 < x ≤ 2 − 2, then we
have (case 1b equilibrium, case 2a equilibrium) if α < α2 (x), and (case 1b equilibrium, case 2b√
equilibrium) if α ≥ α2 (x). Third, if 2 − 2 < x ≤ 1, then we have (case 1b equilibrium, case2b equilibrium) for all α. The lemma follows from this.
Comparing the above three pairs of equilibria, we can show the following.
Proposition A1 The equilibrium price is higher after the GDPR, i.e., pe⋆ > pb⋆ .
Proposition A2 Comparing the equilibria before and after the GDPR, we find the following.
e⋆ > Db ⋆.
• When α < α1 (x), the total demand is larger after the GDPR, i.e., D
e⋆ > Db ⋆ if and only if α < min{α2 (x), α4 (x)} where• When α1 (x) ≤ α < α2 (x), we have D
α4 (x) is the value of α that solves 4β(1 − x − α) + 4α2 + 26xα + 13x2 − 2 − 8(x + α) = 0pand β = 6 + (x + α − 1)2 .
e⋆ > Db ⋆ if and only if α < 1 − x.
• When α ≥ α2 (x), we have D• For all values of α, the opt-in demand after the GDPR is smaller than the total demandb⋆ > De⋆ .
before the GDPR, i.e., D
S• The marginal consumer with lowest privacy cost who shares data has a higher valuation
for the service after the GDPR: ve⋆ > vb⋆ .
Proposition A3
Comparing the equilibria before and after the GDPR, we find the following.
e⋆ > Πb⋆ .
• When α < α1 (x), the firm’s profit is larger after the GDPR, i.e., Π
2a1ae⋆ > Π
b ⋆ if and only if α ≤ min{α2 (x), α5 (x)} where• When α1 (x) ≤ α < α2 (x), we have Π2a1be⋆ = Πb⋆ .
α5 (x) is the value of α that solves Π
2a1be⋆ > Π
b ⋆ if and only if α2 (x) < α < α6 (x) where α6 (x) is the• When α ≥ α2 (x), we have Π
2b
1b
⋆
⋆
e
b
value of α that solves Π = Π .
2b1bFigure 5 illustrates Proposition A3. In the figure, the blue shaded region labeled ∆Π > 0 is
where the firm’s profit increases after the GDPR and the yellow shaded region labeled ∆Π < 0is where the firm’s profit decreases after the GDPR. The curved line dividing these two regions
is defined by α5 (x) and α6 (x) stated in Proposition A3. The two dashed lines divide the set of(α, x) into three regions. The region labeled ‘Reg I’ corresponds to the case where α < α1 (x),‘Reg 2’ corresponds to the case where α1 (x) ≤ α < α2 (x), and ‘Reg 3’ corresponds to the case34

where α ≥ α2 (x). As shown in the figure, for given values of x, the GDPR benefits the firm forsmaller values of α but hurts the firm for larger values of α, with smaller values of x admitting
a larger range of α that benefits the firm. It is because, the smaller x is, the larger is the massof consumers who participate in the market through opt-out purchase after the GDPR, as canbe checked in Figure 5. This leads to a larger demand expansion effect.

e⋆ − Π
b⋆
Figure 5: Comparison of equilibrium profits, ∆Π = Π
Proposition A4 Comparing the equilibria before and after the GDPR, we find the following.
g⋆ > CSd⋆ , if• When α < α1 (x), the consumer surplus is larger after the GDPR, i.e., CS
2a1ag⋆ = CSd⋆ .
and only if α < α7 (x) where α7 (x) is the value of α that solves CS2a1ag⋆2a > CSd⋆1b if and only if α < α8 (x) where α8 (x) is• When α1 (x) ≤ α < α2 (x), we have CS
d⋆1b .
g⋆2a = CS
the value of α that solves CS
g⋆ > CSd⋆ if and only if α < α9 (x) where α9 (x) is the value• When α ≥ α2 (x), we have CS2b1bg⋆2b = CSd⋆1b .
of α that solves CS
Figure 6 illustrates Proposition A4. As before, the two dashed lines are drawn to indicate
Regions I-III. The blue shaded region labeled ∆CS > 0 is where the equilibrium consumer
surplus is larger after the GDPR and the yellow shaded region labeled ∆CS < 0 is where it issmaller after the GDPR. The line dividing these two regions is made up of three pieces: thelowermost part corresponds to the case where α < α1 (x) (Region I) and is defined by α7 (x)stated in Proposition A4; the curve in the middle corresponds to the case where α1 (x) ≤ α <α2 (x) (Region II) and is defined by α8 (x); and the uppermost part corresponds to the casewhere α ≥ α2 (x) (Region III) and is defined by α9 (x). As shown in the figure, for given valuesof x, the GDPR increases consumer surplus for smaller values of α but decreases it for larger
values of α. In addition, the set of (x, α) that leads to larger consumer surplus is smaller than
the set of (x, α) that leads to larger profit, as shown in Figures 5 and 6. This is because theprice increase following the GDPR partially offsets the benefits to consumers.

35

g⋆ − CSd⋆
Figure 6: Comparison of consumer surpluses, ∆CS = CS
Figure 7 combines Figures 5-6 and shows the changes in total surplus. After the GDPR,
total surplus increases in the region where ∆Π > 0 and ∆CS > 0, and decreases in the region
where ∆Π < 0 and ∆CS < 0. In the region where ∆Π > 0 and ∆CS < 0, it increases after
the GDPR if and only if |∆Π| > |∆CS|. Consistent with our main results, the GDPR is more
likely to improve welfare for small values of α but decrease it for large values of α.

Figure 7: Comparison of consumer surpluses and profits

References
Acemoglu, Daron, Ali Makhdoumi, Azarakhsh Malekian, and Asu Ozdaglar (2022) “Too muchdata: Prices and inefficiencies in data markets,” American Economic Journal: Microeconomics, 14 (4), 218–256.
Acquisti, Alessandro (2023) “The economics of privacy at a crossroads,” in Goldfarb, Avi andCatherine Tucker eds. The Economics of Privacy: University of Chicago Press.
Acquisti, Alessandro, Laura Brandimarte, and George Loewenstein (2015) “Privacy and humanbehavior in the age of information,” Science, 347 (6221), 509–514.
36

Acquisti, Alessandro, Curtis Taylor, and Liad Wagman (2016) “The economics of privacy,”
Journal of Economic Literature, 54 (2), 442–492.
Amaldoss, Wilfred, Jinzhao Du, and Woochoel Shin (2024) “Pricing strategy of competing
media platforms,” Marketing Science, 43 (3), 469–496.
Anderson, Simon P. and Joshua S. Gans (2011) “Platform siphoning: Ad-avoidance and media
content,” American Economic Journal: Microeconomics, 3 (4), 1–34.
Aridor, Guy, Yeon-Koo Che, and Tobias Salz (2023) “The effect of privacy regulation on the dataindustry: Empirical evidence from GDPR,” RAND Journal of Economics, 54 (4), 695–730.
Batikas, Michail, Yi Liu, Hakan Ozlap, and Milan Miric (2023) “Impact of privacy regulation
on experimentation and innovation,” Academey of Management Proceedings, 2023 (1), 17060.
Belleflamme, Paul and Wouter Vergote (2016) “Monopoly price discrimination and privacy:
The hidden cost of hiding,” Economics Letters, 149, 141–144.
Bergemann, Dirk and Alessandro Bonatti (2015) “Selling cookies,” American Economic Journal:
Microeconomics, 7 (3), 259–294.
Bergemann, Dirk, Alessandro Bonatti, and Tan Gan (2022) “The economics of social data,”
RAND Journal of Economics, 53 (2), 263–296.
Bessen, James, Stephen Michael Impimk, Lydia Reichensperger, and Robert Seamans(2020) “GDPR and the importance of data to AI startups,”

Discussion Paper,

http://dx.doi.org/10.2139/ssrn.3576714.
Braghieri, Luca (2019) “Targeted advertising and price discrimination in intermediated online
markets,” Discussion Paper, http://dx.doi.org/10.2139/ssrn.3072692.
Campbell, James, Avi Goldfarb, and Catherine Tucker (2015) “Privacy regulation and market
structure,” Journal of Economics & Management Strategy, 24 (1), 47–73.
Chaudhury, Ratul Das and Chongwoo Choe (2023) “Digital privacy: GDPR and its lessons forAustralia,” Australian Economic Review, 56 (2), 204–220.
Chen, Zhijun (2022) “Privacy costs and consumer data acquisition: An economic analysis ofdata privacy regulation,” Discussion Paper, http://dx.doi.org/10.2139/ssrn.4085923.
Chen, Zhijun, Chongwoo Choe, and Noriaki Matsushima (2020) “Competitive personalized
pricing,” Management Science, 66 (9), 4003–4023.
Cheyre, Cristobal, Benjamin T. Leyden, Sagar Baviskar, and Alessandro Acquisti (2023) “The
impact of Apple’s App Tracking Transparency framework on the app ecosystem,” Discussion
Paper, http://dx.doi.org/10.2139/ssrn.4453463.
Choe, Chongwoo, Stephen King, and Noriaki Matsushima (2018) “Pricing with cookies: behaviorbased price discrimination and spatial competition,” Management Science, 64 (12),5669–5687.
37

Choi, Jay Pil, Doh-Shin Jeon, and Byung-Cheol Kim (2019) “Privacy and personal data collection with information externalities,” Journal of Public Economics, 173, 113–124.
Cong, Jiajia and Noriaki Matsushima (2023) “The effects of personal data management oncompetition and welfare,” ISER Discussion Paper 1201.
Congiu, Raffaele, Lorien Sabatino, and Geza Sapi (2022) “The impact of privacy regulation on
web traffic: Evidence from the GDPR,” Information Economics and Policy, 61, 101003.
Fainmesser, Itay P., Andrea Galeotti, and Ruslan Momot (2023) “Digital privacy,” Management
Science, 69 (6), 3157–3173.
Gans, Joshua S. (2022) “The specialness of zero,” The Journal of Law and Economics, 65 (1),
157–176.
Ghose, Anindya (2017) Tap: Unlocking the mobile economy: The MIT Press.
Godinho de Matos, Miguel and Idris Adjerid (2022) “Consumer consent and firm targeting after
GDPR: The case of a large telecom provider,” Management Science, 68 (5), 3330–3378.
Goldberg, Samuel G., Garrett A. Johnson, and Scott K. Shriver (2024) “Regulating privacy
online: An economic evaluation of the GDPR,” American Economic Journal: Economic
Policy, 16 (1), 325–358.
Goldfarb, Avi and Catherine Tucker (2012) “Shifts in privacy conerns,” American Economic
Review, 102 (3), 349–353.
Gopal, Ram. D., Hooman Hidaji, Sule Nur Kutlu, Raymond A. Patterson, and Niam Yaraghi(2023) “Law, economics, and privacy: Implications of government policies on website andthird-party information sharing,” Information Systems Research, 34 (4), 1375–1397.
Hagiu, Andrei and Julian Wright (2023) “Data-enabled learning, network effects and competitive advantage,” RAND Journal of Economics, 54 (4), 638–667.
Ichihashi, Shota (2021) “The economics of data externalities,” Journal of Economic Theory,
196, 105316.
(2023) “Dynamic privacy choices,” American Economic Journal: Microeconomics, 15(2), 1–40.
Janßen, Rebecca, Reinhold Kesler, Michael E. Kummer, and Joel Waldfogel (2022) “GDPR
and the lost generation of innovative apps,” NBER Working Paper 30028.
Jentzsch, Nicola, Geza Sapi, and Irina Suleymanova (2013) “Targeted pricing and customer
data sharing among rivals,” International Journal of Industrial Organization, 31, 131–144.
Jia, Jian, Ginger Zhe Jin, and Liad Wagman (2021) “The short-run effects of the General
Data Protection Regulation on technology venture investment,” Marketing Science, 40 (4),
661–684.

38

Johnson, Eric J., Steven Bellman, and Gerald L. Lohse (2002) “Defaults, framing and privacy:
Why opting in-opting out,” Marketing Letters, 13 (1), 5–15.
Johnson, Garrett A., Scott K. Shriver, and Shaoyin Du (2020) “Consumer privacy choice inonline advertising: Who opts out and at what cost to industry?” Marketing Science, 39 (1),33–51.
Johnson, Garrett A., Scott K. Shriver, and Samuel G. Goldberg (2023) “Privacy and market
concentration: Intended and unintended consequences of the GDPR,” Management Science,69 (10), 5695–5721.
Ke, T. Tony and K. Sudhir (2023) “Privacy rights and data security: GDPR and personal data
markets,” Management Science, 69 (8), 4389–4412.
Lin, Song (2020) “Two-sided price discrimination by media platforms,” Marketing Science, 39(2), 317–338.
Lin, Tesary (2022) “Valuing intrinsic and instrumental preferences for privacy,” Marketing Science, 41 (4), 235–253.
Macha, Meghanath, Natasha Zhang Foutz, Beibei Li, and Anindya Ghose (2024) “Personalized
privacy preservation in consumer mobile trajectories,” Information Systems Research, 35 (1),249–271.
Machuletz, Dominique and Rainer Böhme (2020) “Multiple purposes, multiple problems: A
user study of consent dialogs after GDPR,” Proceedings on Privacy Enhancing Technologies
2020, 2020 (2), 481–498.
Matte, Célestin, Nataliia Bievola, and Cristina Santos (2020) “Do cookie banners respect mychoice?: Measuring legal compliance of banners from IAB Europe’s transparency and consent
framework,” 2020 IEEE Symposium on Security and Privacy, 791–809.
Miklós-Thal, Jeanine, Avi Goldfarb, Avery M. Haviv, and Catherine Tucker (2024) “Digital
hermits,” Marketing Science, forthcoming, https://doi.org/10.1287/mksc.2023.0612.
Nouwens, Midas, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal (2020) “Darkpatterns after the GDPR: Scraping consent pop-ups and demonstrating their influence,”
Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, 1–13.
Obar, Jonathan A. and Anne Oeldorf-Hirsch (2020) “The biggest lie on the Internet: Ignoring
the privacy policies and terms of service policies of social networking services,” Information,
Communication & Society, 23 (1), 128–147.
Peukert, Christian, Stefan Bechtold, Michail Batikas, and Tobias Kretschmer (2022) “Regulatory spillovers and data governance: Evidence from the GDPR,” Marketing Science, 41 (4),318–340.
Pew Research Center (2019) “Americans and privacy: Cencerned, confused and feeling lack ofcontrol over their personal information.”
39

Schmitt,

Julia,

Klaus M. Miller,

and Bernd Skiera (2021) “The impact of pri-vacy laws on online user behavior,” HEC Paris Research Paper No MKG-2021-1437,
http://dx.doi.org/10.2139/ssrn.3774110.
Utz, Christine, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz (2019)“(Un)informed consent: Studying GDPR consent notices in the field,” Proceedings of the2019 ACM SIGSAC Conference on Computer and Communications Security, 973–990.

40

Online Appendix for “The Bright Side of the GDPR: Welfareimproving Privacy Management”
This online appendix provides the details of the solution to the firm’s optimization problem
before and after the GDPR, and the proofs of the results not supplied in the main text or the
appendix.

A

Solution to the firm’s optimization problem

A.1

Before the GDPR

The profit function before the GDPR is given by(1 + x − pb)2

b h := (b
p + α)
if x < pb ≤ x + 1,
 Π
2
b=


Π
2
(1 − x + pb)b l := (b Π
if x − 1 ≤ pb ≤ x.
p + α) 1 −2
b h with respect to pb is
The partial derivative of Πbh∂Π
(1 + x − pb)(1 + x − 2α − 3b
p)
=
.
∂ pb
2
b h has two extreme values: pbh1 := 1 + x and pbh2 := (1 + x − 2α)/3. But pbh1 is a local minimizerΠb h since pbh1 > pbh2 . If pbh2 > x, then pbh2 is a local maximizer of Πb h ; otherwise, x is a localof Π
b h . Since x < pbh2 if and only if 2(x + α) < 1, the solution to the firm’s problem
maximizer of Πb h is locally strictly concave around pbh2
is pbh2 if α < α1 (x) := max{0, (1 − 2x)/2}. Note that Π
b h /∂ pb2 |pb=bp = −α − x − 1 < 0.
since ∂ 2 Πh2
b h when x = 1/4 and α = 1/8 < α1 (x) =In Figure 8, we show the graph of profit function Πb h is defined for 1/4 < pb ≤ 5/4. As shown in the graph, the optimal price is the
1/4, hence Π
b h , which is given by pbh2 = 1/3.
local maximizer of Π
0.25

b h)
Profit (Π

0.2
0.15
0.1

5 · 10−2
0

0.4

0.6
0.8
Price (b
p)

1

1.2

Figure 8: Profit function when x = 1/4 and α = 1/8

1b l with respect to pb is
The partial derivative of Πbl∂Π
1 + 2x − x2 − 2(1 − x)α − 2(2(1 − x) + α)bp − 3b
p2
=
.
∂ pb
2
b l has two extreme values:Πp
6 + (x + α − 1)2
pbl1 :=,3p2(x − 1) − α + 6 + (x + α − 1)2
pbl2 :=.
3
2(x − 1) − α −b l /∂ pb, we find that Πb l decreases in pb for pb < pbl1 ; it increases in
From the functional form of ∂ Π
b l /∂ pb = 1 at pb = x − 1.
pb for pbl1 < pb < pbl2 ; and it decreases in pb for pb > pbl2 . Also, we have ∂ Πb l is increasing around pb = x − 1. In addition, pbl2 ≤ x if and only if 2(x + α) ≥ 1 orThat is, Πα ≥ (1 − 2x)/2. Therefore, pbl2 is the solution to the firm’s problem if α ≥ α1 (x).
b l when x = 1/4 and α = 4/5 > α1 (x) =In Figure 9, we show the graph of profit function Πb l is defined for −3/4 ≤ pb ≤ 1/4. As shown in the graph, the optimal price is the
1/4, hence Πb l , which is given by pbl2 = 1/20.
local maximizer of Πb l)Profit (Π

0.6

0.4

0.2

0

−0.6 −0.4 −0.2
0Price (b
p)

0.2

0.4

Figure 9: Profit function for x = 1/4 and α = 4/5
b is maximized at pb = pbh2 if α < α1 (x),We can summarize the above discussions as follows: Πand at pb = pbl2 if α ≥ α1 (x).

A.2

After the GDPR

The profit function after the GDPR is given by(1 + x − pe)2(e
p + α)
if 1 < pe ≤ x + 1,


2




x2
e h := (ee=+ x(1 − pe) + pe(1 − x)(1 − pe) if x < pe ≤ 1,
Πp + α)
Π
2







pe2

e l := (e Π
p + α) x −+ pe(1 − x)(1 − pe)
if 0 ≤ pe ≤ x,22

e decreases in pe if 1 < pe ≤ x + 1. So, we can ignore this case and focus onFirst, we find that Π
the range of pe ∈ [0, 1].
e h with respect to pe is
The partial derivative of Πeh∂Π2(1 − xα) + x2 − 4e
p
=
.
∂ pe
2
e h has only one extreme value: peh := (2(1 − xα) + x2 )/4. If peh ≥ x, then Πe h is locallyΠ
maximized at peh ; otherwise, it is locally maximized at x. We find that x ≤ peh if and only if
2 − 4x + x2 − 2xα > 0, or α < α2 (x) := max{(2 − 4x + x2 )/(2x), 0}. Thus, peh is the solution to
the firm’s problem if α < α2 (x).
e h when x = 1/4 and α = 1/8 < α2 (x) =In Figure 10, we show the graph of profit function Πe h is defined for 1/4 < pe ≤ 1. As shown in the graph, the optimal price is the local
17/8, hence Π
e h , which is given by peh = 1/2.
maximizer of Πe h)Profit (Π

0.3

0.2

0.1

0

0.4 0.5

0.6
Price (e
p)

0.8

1

Figure 10: Profit function for x = 1/4 and α = 1/8
e l with respect to pe is
The partial derivative of Πel∂Π
2 − 2(2(1 − x) + α)ep − 3e
p2
=
.
∂ pe
2
e l has two extreme values:Πp
6 + (2 − 2x + α)2
pel1 :=,
3p−(2 − 2x + α) + 6 + (2 − 2x + α)2
pel2 :=.
3−(2 − 2x + α) −e l /∂ pe, we find that Πe l decreases in pe for pe < pel1 ; it increases in pe
From the functional form of ∂ Π
e l /∂ pe > 0.
for pel1 < pe < pel2 ; and it decreases in pe for pe > pel2 . In addition, at pe = 0, we have ∂ Π
e l is increasing around pe = 0. Finally, pel2 ≤ x if and only if 2 − 4x + x2 − 2xα ≤ 0 orThat is, Πe l is the solution to the firm’s problem if α ≥ α2 (x).
α ≥ α2 (x). Thus, Πe l when x = 1/4 and α = 3 > α2 (x) =In Figure 11, we show the graph of profit function Π3

e l is defined for 0 ≤ pe ≤ 1/4. As shown in the graph, the optimal price is the local
17/8, hence Π
e l , which is given by pel2 = 0.21.
maximizer of Πe l)Profit (Π

0.9

0.85

0.8

0.75

0

5 · 10−2

0.1
0.15
Price (e
p)

0.2

0.25

Figure 11: Profit function for x = 1/4 and α = 3
e is maximized at pe = peh if α < α2 (x),We can summarize the above discussions as follows: Πand at pe = pel2 if α ≥ α2 (x).

B

Proof of Lemma A1

First, note that ∂β/∂x = ∂β/∂α = |x + α − 1|/β ∈ [0, 1). Differentiating the equilibrium pricewith respect to x, we have1
if α < α1 (x),∂ pb⋆  3 > 0  = 2 1 ∂β∂x
 +> 0 if α ≥ α1 (x).
3 3 ∂xDifferentiating the equilibrium price with respect to α, we obtain 2
if α < α1 (x),∂ pb⋆ − 3 < 0  =
1 1 ∂β∂α− +< 0 if α ≥ α1 (x).
3 3 ∂αDifferentiating the equilibrium demand with respect to k ∈ {α, x}, we obtain 4(1 + x + α) > 0
if 0 < α < α1 (x),b⋆ ∂D= (1 − x9− α + β)2∂k> 0 if α ≥ α1 (x).
9βGiven that both the equilibrium price and demand increase in x, it follows that the firm’s
equilibrium profit also increases in x. Next, differentiating the equilibrium profit with respect4

to α, we obtain 2(1 + x + α)2
b⋆ 
>0
∂Π
9
=

∂α
 5 + (x + α)(2 − x + β − α) − β > 09if α < α1 (x),if α ≥ α1 (x).

To show the second inequality above, let γ := x + α and write the numerator as F (γ) :=5 + γ(2 + β − γ) − β. Noting that ∂β/∂γ = (γ − 1)/β, we have F ′ (γ) = (1 − γ + β)2 /β > 0. Next,√
solving F (γ) = 0, we find a unique solution γ = 1 − 2 < 0. Thus, we must have F (γ) > 0 for
all γ > 0, which proves the second inequality above.
Differentiating the consumer surplus with respect to k ∈ {α, x}, we have4(1 + x + α)2


>0
d
∂ CS
27

= F (γ) 
1
−
γ

∂k

1+
>0
54
β
⋆

if α < α1 (x),if α ≥ α1 (x).

The second inequality above follows from the fact that F (γ) > 0 for all γ > 0 as shownp
previously, and β = 6 + (1 − γ)2 > |1 − γ|.

C

Proof of Lemma A2

Differentiating the equilibrium price with respect to x gives usx−αif α < α2 (x),


⋆
2
!
∂ pe
= 2
2 − 2x + α∂xif α ≥ α2 (x).
3 1 − p
6 + (2 − 2x + α)2
The first derivative is negative if and only if x < α. The second derivative is always positivep
because 0 ≤ 2 − 2x + α < 6 + (2 − 2x + α)2 .
Differentiating the equilibrium price with respect to α, we obtain

x

− <0
if α < α2 (x),


⋆
2
!
∂ pe
=
2 − 2x + α1
∂α< 0 if α ≥ α2 (x).
− 3 1 − p
6 + (2 − 2x + α)2
Differentiating the equilibrium opt-in demand with respect to x leads to
2 + 4x − 3x2 + 4xα
⋆>0if α < α2 (x),
e
∂ DS
4

= 1
12

∂x

9 + 4(2(1 − x) + α) +− 4Γ) > 0 if α ≥ α2 (x)9Γp
6 + (2 − 2x + α)2 . The first inequality above holds because x ∈ [0, 1]√
and α ≥ 0. To prove the second inequality, define z := 2 − 2x + α ≥ 0, hence Γ = 6 + z 2 . Let√
12G(z) := 9 + 4z + √6+z
− 4 6 + z 2 . Solving G(z) = 0, we obtain a unique solution z̃ ≈ −0.826.
2
where we recall Γ :=In addition, we can check G′ (z̃) ≈ 0.65 > 0. These two imply G(z) > 0 for all z ≥ 0.
5

Differentiating the equilibrium opt-in demand with respect to α, we have 2x > 0
⋆
e
∂ DS
2
=
2
(2

∂α
 − 2x + α − Γ) > 0
9Γ

if α < α2 (x),if α ≥ α2 (x).

Differentiating the equilibrium opt-out demand with respect to x, we obtain 2
3x − 2x − 4xα + 2α − 2if α < α2 (x),
e⋆
∂D
N
4


= 1
(2 − 2x + α)∂x
−5 + 2x − α + Γ − 2(1 − x) 1 −if α ≥ α2 (x).
3ΓFirst, consider the case where α < α2 (x). Recall that this case is possible when α2 (x) > 0, or√√
x < 2 − 2 ≈ 0.58, hence the relevant parameter range is A := {(x, α) ∈ R+
2 |x < 2 − 2, α <e ⋆ /∂x = 0 for α yields α3 (x) := (2 + 2x − 3x2 )/(2 − 4x) and we have
α2 (x)}. Solving ∂ DN√
α3 (x) < α2 (x) when x < −4 + 3 2 ≈ 0.24. In addition, limx→1/2 α3 (x) = ∞ and α3 (x) < 0 if√
1/2 < x < 2 − 2. Let G(α) := 3x2 − 2x − 4xα + 2α − 2. Then G′ (α) ≥ 0 iff x ≤ 1/2. Based√on the above, we can consider by dividing A into three regions: (i) If x < −4 + 3 2 < 1/2,
then we have α3 (x) < α2 (x) and G′ (α) > 0, hence G(α) > 0 for all α3 (x) < α < α2 (x); (ii)√
If −4 + 3 2 ≤ x < 1/2, then we have α3 (x) ≥ α2 (x) and G′ (α) > 0, hence G(α) ≤ 0 for all√
α < α3 (x) < α2 (x); (iii) If 1/2 < x < 2 − 2, then α3 (x) < 0 and G′ (α) < 0, hence we haveG(α) < 0 for all α3 (x) < α < α2 (x). From these, we can conclude that, if α < α2 (x), thene ⋆ /∂x > 0 if and only if α3 (x) < α < α2 (x). Consider next the case where α ≥ α2 (x).
∂DNe ⋆ /∂x with respect to x leads toDifferentiating ∂ DNe⋆∂2D
4(6(1 − x) + Γ2 )(Γ − (2 − 2x + α))
N
=
>0
∂x2
3Γ3
p
where the inequality follows because Γ := 6 + (2 − 2x + α)2 > 2 − 2x + α and x ≤ 1. At√e ⋆ /∂x = (−3 − α + 6 + α2 )/3 < 0. Thus we have ∂ D
e ⋆ /∂x < 0 for
x = 1, we have ∂ D
NN

e ⋆ /∂x > 0 if and only if
all x ≤ 1. Combining the above two cases, we have shown that ∂ DNα3 (x) < α < α2 (x).
Differentiating the equilibrium opt-out demand with respect to α, we havex(1 − x)>0
if α < α2 (x),

e⋆
2
∂D
!
N
= (1 − x)
2 − 2x + α

∂α

1− p
> 0 if α ≥ α2 (x).
 3
6 + (2 − 2x + α)2
Differentiating the equilibrium total demand with respect to x leads tox + α > 0e⋆ ∂D= 142+ 8x2 + α(2 − α) − 2x(8 + α) − Γ(4 − 4x − α)

∂x

9Γ

if α < α2 (x),if α ≥ α2 (x).

Analytically evaluating the sign of the second derivative is demanding. Instead, we numericallye ⋆ /∂x and plot the range of (x, α) for which ∂ D
e ⋆ /∂x > 0. We find that
calculate the value of ∂ D
6e ⋆ /∂x > 0 for all (x, α) ∈ B := {(x, α) ∈ R+ |x ≤ 1, α ≥ α2 (x)}, that is, the entire range of α∂D
2in this case.
Differentiating the equilibrium total demand with respect to α, we have

x

 >0
⋆
e
∂D
= 82 + 2x2 + α(5 + 2α) − Γ(1 + 2α − x) − x(4 + 5α)

∂α

9Γ

if α < α2 (x),if α ≥ α2 (x).

For the sign of the second derivative, we again rely on the numerical method and verify thate ⋆ /∂α > 0 for all (x, α) ∈ B.
∂D
Comparative statics of the equilibrium profit and consumer surplus can be done in the same
way as that for the equilibrium total demand. So we omit the proof. For the case α < α2 (x),e ⋆ /∂x > 0, ∂ Πe ⋆ /∂α > 0, ∂ CSg⋆ /∂x > 0, and ∂ CSg⋆ /∂α > 0. For the case
it is easy to check ∂ Πα ≥ α2 (x), we can use the numerical method to verify that all the derivatives are positive forall (x, α) ∈ B.

D

Proof of Proposition A1

Based on the equilibria shown in the appendix, we can calculate the difference in the equilibrium
prices before and after the GDPR as follows:
2 + 8α − x(4 + 6α − 3x)




122

14
+
4α
+
3x
− 8x − 6xα − 4β⋆⋆pe − pb =

12



Γ − β3if α < α1 (x),if α1 (x) ≤ α < α2 (x),if α2 (x) ≤ α.

Consider the case where α < α1 (x). This case is possible when x ≤ 1/2, which implies
2 + 8α − x(4 + 6α − 3x) > 0. Thus we have pe⋆ > pb⋆ . Moreover, x ≤ 1/2 implies ∂∆p∗ /∂α > 0.
√
Consider next the case where α1 (x) ≤ α < α2 (x), which is possible when x < 2− 2. We willshow pe⋆ > pb⋆ . Denote the numerator of pe⋆ − pb⋆ by F (x, α). First, note that ∂F (x, α)/∂x < 0√because ∂F (x, α)/∂x = 6(x − α) − 8 − 4(∂β/∂α) and x < 2 − 2, α ≥ 0, and ∂β/∂α >0. Having established ∂F (x, α)/∂x < 0, it suffices to show that, for all α ∈ [α1 (x), α2 (x)),
we have F (x, α) ≥ 0 for the maximum possible value of x for given α, which we denote byx(α). We can derive x(α) by solving α = α2 (x). Since x ∈ [0, 1], we have x(α) = (2 + α) −pp2 − 2. Calculating F (x(α), α), we have F (x(α), α) = 4(2(2 + α) − ( (2 + α)2 − 2 +
(2
+
α)
q
p
9 − 2(1 + 2α) (2 + α)2 − 2 + α(8 + 5α))). In the following, we show that F (x(α), α) > 0.
First, solving F (x(α), α) = 0, we obtain two solutions α = −1/2 and α = −1/6. Next, we
can calculate (∂F (x(α), α)/∂α) |α=−1/6 = 72/35 > 0. This inequality is sufficient to show
F (x(α), α) > 0 for all α > 0 since F (x(α), α) = 0 has only two solutions α = −1/2 andα = −1/6 > −1/2.
Finally, for the case α ≥ α2 (x), recall Γ =p

6 + (2(1 − x) + α)2 and β =Thus, we have Γ > β, hence pe⋆ − pb⋆ > 0.

7p
6 + (1 − x − α)2 .

EProof of Proposition A2

Comparing the equilibrium total demands before and after the GDPR, we have
10 + x2 − 16x − 2α(8 − x) − 8α2





36 2

4β(1
−
x
−
α)
+
4α + 26xα + 13x2 − 2 − 8(x + α)⋆⋆eb
D −D =
36
(1 − x − α)(3(1 − x) + β − Γ)9if α < α1 (x),if α1 (x) ≤ α < α2 (x),if α2 (x) ≤ α.

Consider the case where α < α1 (x) = (1−2x)/2, when we have α ≤ 1/2 and x ≤ 1/2. Denotee⋆ − Db ⋆ by H(x, α). Given α ≤ 1/2 and x ≤ 1/2, we have ∂H(x, α)/∂x =the numerator of D2(x+α−8) < 0 for all (x, α). We will show that H(x, α) ≥ 0 for all (x, α). Since ∂H(x, α)/∂x <0, it is sufficient to show H(x, α) ≥ 0 for the maximum possible value of x given α for allα ≤ 1/2. Such x solves α = α1 (x), hence x = (1 − 2α)/2. By direct calculation, we havee⋆ ≥ Db ⋆ ifH((1 − 2α)/2, α) = (9 − 36α2 )/4 ≥ 0 since α ≤ 1/2. Thus we have shown D
α < α1 (x).
Consider next the case where α1 (x) ≤ α < α2 (x). Analytically evaluating the sign of⋆eb ⋆ is quite demanding. Instead, we numerically calculate its value for all (x, α) such thatD −D
α1 (x) ≤ α < α2 (x). In Figure 12, the straight line in the lower border of the shaded area
corresponds to α = α1 (x) and the curved line in the upper border is α = α2 (x). Thus, Figure
12 shows how the set {(x, α)|x ∈ [0, 1], α1 (x) ≤ α < α2 (x)} is divided into two regions. The
region labeled ∆D > 0 is where the equilibrium demand is larger after the GDPR and the arealabeled ∆D < 0 is where the equilibrium demand is smaller after the GDPR. The curved linee⋆ = Db ⋆ , which defines α4 (x).
that divides the two areas is where D

Figure 12: Comparison of total equilibrium demands when α1 (x) ≤ α < α2 (x)Finally, consider the case where α ≥ α2 (x), which is possible for all x ≤ 1. First, we establishthat G(x, α) := 3(1 − x) + β − Γ is always positive. Differentiating G(x, α) with respect to x
yields∂G(x, α)|x + α − 1| 2(2 − 2x + α)
= −3 +
+
.
∂x
β
Γ

8

Recall β =pp
6 + (x + α − 1)2 and Γ = 6 + (2 − 2x + α)2 . Thus we have |x + α − 1|/β < 1

and (2 − 2x + α)/Γ < 1, hence ∂G(x, α)/∂x < 0. Next, we have G(1, α) = 0, which implies
G(x, α) > 0 for all x < 1 since x = 1 is the maximum possible value of x and ∂G(x, α)/∂x < 0.
e⋆ − Db ⋆ is the same as the sign of (1 − x − α), from which follows De⋆ ≥ Db⋆
Thus, the sign of D
iff 1 − x ≥ α.
e⋆ < Db ⋆ for all α. By direct calculation, we have
Next, we show DS
9x3 + 8(1 + α)2 − x(2 − 16α) − 2x2 (5 + 9α)



−


36


3 + 4(5 − α2 − β + α(2 + β)) − 2x(x(11 + 9α) + 5 + 4α − 2β)9xe S⋆ −Db⋆ = −D362 − β − x(15 + 6α − β − 2Γ) − 2Γ + α(6 + β − Γ)

12
+
3x
−

9

if 0 < α < α1 (x),if α1 (x) ≤ α < α2 (x),if α2 (x) ≤ α.

e⋆ − Db ⋆ )/∂α < 0 since x < 1/2 inConsider the case where α < α1 (x). It is easy to see ∂(DSe⋆ − Db ⋆ < 0 when α = 0. Thus we have De⋆ < Db ⋆ . For the other two
this case. Moreover, DSSe⋆ − Db ⋆ and plot the range of (x, α) for whichcases, we numerically calculate the value of DSe⋆ < Db ⋆ . When α1 (x) ≤ α < α2 (x), we find that De⋆ < Db ⋆ for all (x, α) ∈ {(x, α) ∈ R+ |x <
D
2
S
S
√
2 − 2, α1 (x) ≤ α < α2 (x)}, i.e., the entire range of α in this case. When α ≥ α2 (x), we findb ⋆ for all (x, α) ∈ {(x, α) ∈ R+ |x ≤ 1, α2 (x) ≤ α}, i.e., the entire range of α in thise⋆ < Dthat D
2

S

case.

F

Proof of Proposition A3

First, when α < α1 (x), the difference in equilibrium profits can be calculated as422e⋆ − Πb ⋆ = 76 + 27x − 96α − 32α (3 + α) + 12x (1 + α)(1 + 9α)Π432
3
4x (8 + 27α) + 24x(4 + 4α2 − α).
−432e⋆ − Πb ⋆ by J(x, α). We will show Πe⋆ > Πb ⋆ by proving J(x, α) > 0
Denote the numerator of Π
for all (x, α) such that α < α1 (x) = (1 − 2x)/2 and x < 1/2. First, note that J(x, α1 (x)) =(1 − x)2 x(4 + 9x)/16 > 0 for all x < 1/2. Then, to prove J(x, α) > 0 for all (x, α), it is sufficient
to show ∂J(x, α)/∂α < 0 for all (x, α). For this, it is sufficient to show ∂J(x, 0)/∂α < 0and ∂ 2 J(x, α)/∂α2 < 0. Notice that ∂J(x, 0)/∂α = −(8 − x(2 + x(10 − 9x)))/36 < 0 for allx ∈ (0, 1/2). Thus, it suffices to show ∂ 2 J(x, α)/∂α2 < 0. To prove this, it is sufficient to show
∂ 2 J(x, 0)/∂α2 < 0 and ∂ 3 J(x, α)/∂α3 < 0. But ∂ 2 J(x, 0)/∂α2 = −(8 + x(8 − 9x))/18 < 0and ∂ 3 J(x, α)/∂α3 = −4/9 < 0. Thus, we have shown J(x, α) > 0 for all (x, α) such thate⋆ > Πb ⋆.
α < α1 (x) = (1 − 2x)/2 and x < 1/2, hence Π

9Next, when α1 (x) ≤ α < α2 (x), the difference in equilibrium profits is given by432e⋆ − Πb ⋆ = 27x + 4x (8 − 27α) + 4x (3 + 3α(26 + 9α) − 4β)Π432
28x(12α + α(3 − 4β) − 2(6 − β(2 − β)))+432
34(67 + 8α − 4β(7 − β) − 4α2 (6 + β) − 4α(6 − β(2 − β)))+.
432e ⋆ −Π
b ⋆ is quite demanding. Instead, we numerically calculate
Analytically evaluating the sign of Π
its value for all (x, α) such that α1 (x) ≤ α < α2 (x), which is plotted in Figure 13, where thestraight line in the lower border of the shaded area corresponds to α = α1 (x) and the curved
line in the upper border is α = α2 (x). The region labeled ∆Π > 0 is where the equilibrium
profit is larger after the GDPR and the area labeled ∆Π < 0 is where the equilibrium profit issmaller after the GDPR. The line that divides the two areas is where ∆Π = 0, which defines
α5 (x).

Figure 13: Comparison of equilibrium profits when α1 (x) ≤ α < α2 (x)Finally, when α2 (x) ≤ α, the difference in equilibrium profits is given by3322e⋆ − Πb ⋆ = 10Γ + 10x + α + β − x (30 + 6α + β − 4Γ)Π27
α(27 − 4Γ − β(2 − β)) + α2 (12 + β − Γ) + α(12 + β − Γ)−27
x(8Γ + α(4Γ + 2β − 39) − β(2 − β) − 36 − 12α2 ) + 16 + 7β
−
.
27

10

Figure 14: Comparison of equilibrium profits when α > α2 (x)e⋆ −Πb ⋆ for all (x, α) such that α2 (x) ≤ α, which is plottedOnce again, we numerically calculate Πin Figure 14, where the curved line in the lower border corresponds to α = α2 (x). The region
labeled ∆Π > 0 is where the equilibrium profit is larger after the GDPR and the area labeled∆Π < 0 is where the equilibrium profit is smaller after the GDPR. The curved line that divides
the two areas is where ∆Π = 0, which defines α6 (x).

G

Proof of Proposition A4

The proof is by numerical calculations. For the case α < α1 (x), the difference in equilibrium
consumer surpluses is given by
43g⋆2a − CSd⋆1a = 196 − 128α(α(α + 3) + 3) − 243x + 4(81α + 76)x
∆CS1 := CS
2592
24x(16 + α(5 + 16α)) + 12x2 (5 + α(32 − 27α))
−
.
2592

In Figure 15, the entire shaded area is the set {(x, α)|x ∈ [0, 1], α < α1 (x)}, and the regiong⋆ > (<) CS
d⋆ . The line that divides
labeled ∆CS > (<) 0 is the set of (x, α) for which CS
2athese two regions is where ∆CS1 = 0, which defines α7 (x).

11

1aFigure 15: Consumer surplus comparison when α < α1 (x)When α1 (x) ≤ α < α2 (x), the difference in equilibrium consumer surpluses is given by⋆⋆

g − CSd =∆CS2 := CS2a1b12x2 (23 + 4α + 27α2 − 4β) + 4x3 (112 + 81α) − 243x4
2592
2
24x(34 − 23α − 2α − β(4 − 4α + 2β)) + 4(355 − 4α3 − 204β + 12β 2 )
−
2592
3
2
4(4β + 12α (1 + β) + 12α(17 − 2β + β 2 ))
.
−
2592

In Figure 16, the straight line in the lower border of the shaded area corresponds to α = α1 (x)and the curved line in the upper border is α = α2 (x). Thus, Figure 16 shows how the set{(x, α)|x ∈ [0, 1], α1 (x) ≤ α < α2 (x)} is divided into two regions. The region labeled ∆CS >g⋆2a > (<) CSd⋆1b . The line that divides the two regions is(<) 0 is the set of (x, α) for which CS
where ∆CS2 = 0, which defines α8 (x).

Figure 16: Consumer surplus comparison when α1 (x) ≤ α < α2 (x)12When α ≥ α2 (x), the difference in equilibrium consumer surpluses is given by2g⋆ − CSd⋆ = 81(1 − x) − 54(Γ − β) + (Γ + 7(1 − x) − α)(2 − 2x + α − Γ)∆CS3 := CS
2b
1b
162
3
(1 + β − x − α)
.
−
162

2

Figure 17: Consumer surplus comparison when α > α2 (x)In Figure 17, the curved line in the lower border of the shaded area corresponds to α = α2 (x).
Thus, Figure 17 shows how the set {(x, α)|x ∈ [0, 1], α > α2 (x)} is divided into two regions.
g⋆ > (<) CS
d⋆ . The line that
The region labeled ∆CS > (<) 0 is the set of (x, α) for which CS
2b

1b

divides the two regions is where ∆CS3 = 0, which defines α9 (x).

H

Proof of Proposition 5

Consider the case of positive correlation where c = ϕv with ϕ ∈ (0, 1) and x < ϕ. First,
before the GDPR, consumer v is indifferent between purchase and no purchase if and only if
v + (x − c) − p = 0. Substituting c = ϕv and solving for v, we obtain vb = (p − x)/(1 − ϕ). Then,bbb
the demand is D(p)= 1 − vb = (1 + x − ϕ − p)/(1 − ϕ). The firm maximizes Π(p)= (p + α)D(p),which gives us the equilibrium price and demand as follows:pb∗ =1 + x − α − ϕ b∗ 1 + x + α − ϕ
, D =
.
2
2(1 − ϕ)After the GDPR, consumer v chooses opt-out purchase if c = ϕv ≥ x and v ≥ p. Denote ve =x/ϕ. Then ve < 1 by the assumption x < ϕ and all consumers on [ev , 1] choose opt-out purchaseif ve ≥ p. Next, we show that if consumers on [ev , 1] choose opt-out purchase, then we must haveve ≥ vb. Suppose to the contrary that ve − vb = (x − ϕp)/(ϕ(1 − ϕ)) < 0, hence p > x/ϕ = ve. This
contradicts the fact that consumer ve is the marginal consumer who chooses opt-out purchase.
As shown previously, the marginal consumer who chooses opt-in purchase is vb = (p − x)/(1 − ϕ).
e
Put together, the total demand is D(p)= 1 − vb = (1 + x − ϕ − p)/(1 − ϕ), and the total opt-in
e S (p) = ve − vb = (x − ϕp)/(ϕ(1 − ϕ)). The firm maximizes Π(p)eee S (p).
demand is D
= pD(p)
+ αD
13

b
e
b
e S (p))Comparing the profits before and after the GDPR, we have Π(p)− Π(p)= α(D(p)−D′′beb (p) = De (p), which implies that the equilibrium pricesince D(p)= D(p).
It is easy to see D
Sb∗ = De ∗.
and demand after the GDPR the same as those before the GDPR, i.e., pb∗ = pe∗ and D
Given that the equilibrium price and total demand are the same under both regimes but thee∗ < De∗ = Db ∗ after the GDPR, it follows that the firm’s
firm earns data-based revenue from D
Sb∗ > Π
e ∗ . After the GDPR, consumer surplus
equilibrium profit is smaller after the GDPR: Πdoes not change for all consumers on [0, ve∗ ], but increases for consumers on [ev ∗ , 1] because theychoose opt-out purchase after the GDPR given c = ϕv > x. Consequently, the consumer surplus
is larger in the equilibrium after the GDPR.
Consider now the case of negative correlation where c = 1 − v. First, before the GDPR,
consumer v is indifferent between purchase and no purchase if and only if v + (x − c) − p = 0.
Substituting c = 1 − v and solving for v, we obtain vb = (1 − x + p)/2. Then, the demand is
b
b
b
D(p)
= 1 − vb = (1 + x + p)/2. The firm maximizes Π(p)= (p + α)D(p).
From this, we canderive the equilibrium price, demand, profit, and consumer surplus as follows:pb∗ =1 + x − α b ∗ 1 + x + α b ∗ (1 + x + α)2 d∗ (1 + x + α)2
, D =
, Π =
, CS =.
2
4
8
16

In the above, the equilibrium price is positive because of the restriction α < 1 + x.
After the GDPR, consumer v chooses opt-out purchase if 1 − v = c ≥ x and v ≥ p. Denoteṽ = 1 − x. Then ve < 1 since x > 0. For all v < ve, we have c = 1 − v > 1 − ve = x. Thus, allconsumers on [p, ve] choose opt-out purchase and all consumers on [ev , 1] choose opt-in purchase.
ee S (p) = 1 − ve = x. The
This gives us the total demand D(p) = 1 − p and the opt-in demand Deee S (p), which leads tofirm maximizes Π(p)= pD(p)+ αD
2e S∗ = x, Πe ∗ = 1 + αx, CSg∗ = 4x − 8x + 9 .
e∗ = 1, D
pe∗ = D248e∗ ≥ Db ∗ if and only if
Comparing the above, we have pe∗ ≥ pb∗ if and only if α ≥ x and D
α ≤ 1 − x. For the comparison of profits, note that22e∗ − Πb ∗ = −α + 2(3x − 1)α + (1 − 2x − x ) := H(α) .
Π88√The equation H(α) = 0 has two solutions denoted by αL (x) := (3x − 1) − 8x2 − 8x + 2 and√αH (x) = (3x − 1) + 8x2 − 8x + 2. One can check that αL (x) increases in x, αL (xL ) = 0 at
xL ≈ 0.414, and αL (x) < 1 + x for all x ∈ (0, 1]. Also, αH (x) increases in x, αH (x) > 0 for allx ∈ (0, 1], and αH (x) ≤ 1 + x if and only if x ≤ xH ≈ 0.707. From the above, we can concludee∗ ≥ Π
b ∗ if and only if α ≤ αH (x). Second, if x ∈ [xL , xH ),the following. First, if x < xL , then Πe∗ ≥ Π
b ∗ if and only if α ∈ [αL (x), αH (x)]. Third, if x ≥ xH , then Πe∗ ≥ Π
b ∗ if and only ifthen Π
α ≥ αL .
For the comparison of consumer surpluses, note that22g∗ − CSd∗ = −α − 2(1 + x)α + 7x − 18x + 17 := G(α) .
CS1616The equation G(α) = 0 has two solutions, one negative and the other positive. The positive
14

solution is given by αCS (x) := −(1 + x) +√8x2 − 16x + 18. Once can check that αCS (x) is

decreasing in x, αCS (x) > 0 for all x ∈ (0, 1], and αCS (x) ≥ 1 + x for all x ≤ xCS ≈ 0.65g∗ ≥ CSd∗ for all
where 1 + x is an upper bound on α. From the above, we can conclude that CS
α < 1 + x if x < xCS , and for all α ≤ αCS if x ≥ xCS .

I

Analysis of Section 6.2

Suppose a type-(v, c) consumer’s expected privacy cost is f (α)c where f is an increasing functionof α. We assume f (0) > 0 such that the expected privacy cost from data sharing is positive
even if the firm’s business model is purely usage-driven. We also assume f is bounded aboveby 1. Given this, a type-(v, c) consumer’s utility from opt-in purchase at price p changes fromUS (v, c) = v + x − c − p to US (v, c) = v + x − f (α)c − p. The rest of the baseline model remains
the same.
In the following, we consider the case where f is given by f (α) = k + (1 − k)α for somek ≤ 1.43 We restrict the value of k such that f (α)c > x. This is to rule out the trivial casewhere all consumers choose opt-in purchase, in which case the GDPR does not have any impact.

I.1

Equilibrium before the GDPR

A consumer of type (v, c) buys the service if and only if
US (v, c) ≥ 0 =⇒ c ≤ c(v, p) :=

v+x−p
.
f (α)

In the above, c(v, p) is the privacy cost that makes the consumer indifferent between opt-in
purchase and no purchase given her valuation v and price p. Then, c(1, p) = 1+x−pf (α) is thethreshold value of privacy cost above which there is no demand for the service. Likewise,v(p) := p − x is the threshold value of consumer valuation for the service, below which there isno demand for the service. The conditions v(p) > 0 or v(p) ≤ 0, leads to two possible cases, as
shown in Figure 18. Due to the presence of f (α), we have a third case which is characterized by
the condition that c(1, p) < 1. Thus, the three cases can be characeterized as 0 < v(p) < 1 and
0 < c(1, p) < 1, i.e., 1 − f (α) + x < p < 1 + x, is illustrated in panel (a) in Figure 18, which wecall case 1a. Second, panel (b) in Figure 18 shows the demand for the case where 0 < v(p) < 1
and c(1, p) > 1, or x < p ≤ 1 − f (·) + x, which we call case 1b. Third, panel (c) in Figure 18
shows the demand for the case where v(p) < 0 and c(1, p) > 1, or x − 1 < p ≤ x, which we callcase 1c.
43

Focusing on the case α ∈ [0, 1] is at no loss of our main insight. In all the figures that accompany our general
results provided in the appendix, we consider the case where α ≤ 1. In addition, in all the results presented inTable 4-6, the critical threshold values of α are less than 1. We do not expect our main insight to change forother functional forms for f insofar as f is an increasing function of α bounded above by 1.

15

1

c

1

c
1

c

c(1, p)Opt-in0v(p)(a) Case 1a: 0 < v(p) < 1,
0 < c(1, p) < 1− fv(p)(α)

Opt-in
1

v

0

1

v(p)

Opt-inv(b) Case 1b: 0 < v(p) < 1,c(1, p) > 1

0

1

v

(c) Case 1c: −1 < v(p) ≤ 0,c(1, p) > 1

Figure 18: Demand before the GDPR
The associated demand for the firm’s service isZ
1 Z c(v,bp)

(1 + x − pb)2


dcdv
=


2f (α) v(bp) 0

Z 1
Z 1
Z f (α)+v(bp) Z c(v,bp)
f (α)
b p) =
D(bdcdv +
dcdv = 1 − p + x −

2

p)
0

Zf 1(α)+v(bp) Z0 1
Zv(bf (α)+v(bp) Z c(v,b
p)


(f
(α)
−
x
+ pb)2


dcdv
+
dcdv
=
1
−

2f (α)
00
f (α)+v(bp) 0

if 1 − f (α) + x < pb < 1 + x,
if x < pb ≤ 1 − f (α) + x,
if x − 1 < pb ≤ x.

b p) = (bb p). Solving the first-order
The firm chooses pb to maximize its profit given as Π(bp +α)D(bcondition for pb, we obtain pb.

pb⋆ = 1 + x − 2α




3

 2(1 + x − α) − f (α)

if 1 − f (α) + x < pb⋆ < 1 + x,


4

p



2x
−
α
−
2f (α) + (x + α − f (α))2 + 6f (α)
3if x < pb⋆ ≤ 1 − f (α) + x,
if x − 1 < pb⋆ ≤ x.

As in the main text, the range for each of these three cases can be expressed in terms of α,as shown below:(Case 1a) 0 < v(bp⋆ ) < 1 and 0 < c(1, pb⋆ ) < 1 implies α < α1a := max{ 3k−2x−2
3k−1 , 0};(Case 1b) 0 < v(bp⋆ ) < 1 and c(1, pb⋆ ) ≥ 1 implies α1a < α < α1b := max{ 2−k−2x
3−k , 0};(Case 1c) v(bp⋆ ) ≤ 0 and c(1, pb⋆ ) ≥ 1 implies α ≥ α1b .
Substituting pb⋆ into the demand, we obtain the equilibrium price and demand as
1 + x − 2α 2(1 + x + α)2
,
in Case 1a,3
9f (α)
2(1 + x − α) − f (α) 1 + x + α f (α)
b ⋆) =(bp⋆ , D,−in Case 1b,

4
2
4






2x − α − 2f (α) + β(x + α − f (α) − β)2, 1−
in Case 1c,
318f (α)where β :=pb ⋆ = (bb ⋆ (b(x + α − f (α))2 + 6f (α). The corresponding profit Πp⋆ + α)Dp⋆ ) and16⋆d can be calculated asconsumer surplus is CS3b ⋆ = 2(1 + x + α)in Case 1a,Π1a27f (α)2b⋆ = Πb ⋆ = (2(1 − x − α) − f (α))Π
in Case 1b,
1b

16



2
 ⋆

b = (2(x + α − f (α)) + β)(6f (α) − (x + α − f (α)) + β(x + α − f (α))) in Case 1c.
Π1c
27f (α)

3
⋆
4(1
+
x
+
α)

d =

in Case 1a,
CS

1a

81f (α)




2
2
⋆
d
d⋆1b = 12(1 + x + α) + 7f (α) − 12f (α)(1 + x + α)
CS = CSin Case 1b,

96





p⋆ − x)3 + 3f (α)(1 − pb⋆ + x)2 + f (α)3 − 3f (α)2 (1 + x − pb⋆ )CSd⋆ = (bin Case 1c.
1c6f (α)

I.2

Equilibrium after the GDPR

After the GDPR, a consumer of type (v, c) chooses opt-in purchase if US ≥ max{UN , 0}, opt-out
purchase if UN ≥ max{US , 0}, and no purchase if max{US , UN } ≤ 0. Thus, the set of consumers
choosing opt-in purchase is given by{(v, c) ∈ [0, 1] × [0, 1] | c ≤v+x−p, x ≥ f (α)c},f (α)

and the set of consumers choosing opt-out purchase is given by{(v, c) ∈ [0, 1] × [0, 1] | v ≥ p,

x
< c}.
f (α)

As before, US ≥ 0 leads to the threshold condition, c ≤ c(v, p) = v+x−pf (α) . Then, v(p) = p − xis the threshold value of consumer valuation for the service, below which no consumers choose
opt-in purchase. Next, UN ≥ 0 if v ≥ p, which leads to vN (p) := p, the threshold valueof consumer valuation, below which no consumers choose opt-out purchase. Clearly, we havev(p) ≤ vN (p). In addition, US ≥ UN holds if and only if x ≥ f (α)c. Once again, we have two
possible cases, depending on v(p) > 0 or v(p) ≤ 0. These are depicted in Figure 19, where thearea labeled opt-in represents the demand from consumers who choose opt-in purchase and thearea labeled opt-out is the demand from consumers who choose opt-out purchase. Panel (a)illustrates the demand for case 2a where 0 < v(p) < 1, i.e., x < p < 1, and panel (b) shows
the demand for case 2b where −1 < v(p) ≤ 0, i.e., x − 1 < p ≤ x. As expected, the additional
opt-out purchase made available by the GDPR allows consumers to self-select themselves: thosewith low privacy costs choose opt-in purchase in order to enjoy the opt-in benefits; those withhigh privacy costs choose opt-out purchase to avoid the privacy costs.

17

1

c

1

c
Opt-outOpt-out
x
f (α)

x
f (α)

Opt-in0v(p)1vN (p)

v

Opt-in− fv(p)(α)

0 vN (p)1v(b) Case 2b: −x < v(p) ≤ 0(a) Case 2a: 0 < v(p) < 1

Figure 19: Demand after the GDPR
From the above, we can calculate the opt-in, opt-out, and total demands as follows.44 First,
the opt-in demand isZ v (ep) Z c(v,ep)
Z 1 Z xNx(1 − pe)x2
+
dcdv +
dcdv =


2f
(α)
f (α)
v(e
p)
0
vN (e
p) 0
e S (eDp) = Z v (ep) Z c(v,ep)
x
Z
Z
1
N

f (α)
2x − pe2

dcdv =
dcdv +
2f (α)
0
0
vN (e
p) 0

if x < pe < 1,
if x − 1 < pe ≤ x.

The expression for the opt-out demand is the same in both cases and is given byZ 1
e N (e
D
p) :=

Z 1


dcdv =

vN (e
p)

x
f (α)

1−

x
f (α)


(1 − pe).

The total demand is then
 2
x


+ 1 − pe2f (α)
e
e
e


D(e
p) = DS (ep) + DN (e
p) =

x
pe2

1 − 1 −pe −f (α)
2f (α)

if x < pe < 1,
if x − 1 < pe ≤ x.

e p) = peD(ee p) + α D
e S (e
The firm chooses pe to maximize Π(ep). As before, we can restate theconditions for Case 2a and Case 2b in terms of α in equilibrium. Consistent with the casebefore the GDPR, Case 2a arises for small values of α < α2 (x) and Case 2b, for large values ofα ≥ α2 (x) where(
α2 (x) :=

1
max

n

2k−4kx+x2
2(3x−2kx−1+k) , 0

o if k < (1 − 3x)/(1 − 2x) and x ≤ 1/3,
otherwise.

Put together, we can write the equilibrium price after the GDPR as
44

We ignore the case with v(p) > 1 as this case never arises in equilibrium.

182(f (α) − αx) + x2

4f (α)pe⋆ = Γ − (2f (α) − 2x + α)3where Γ :=if α < α2 (x),if α ≥ α2 (x).

p
6f (α) + (α + 2(f (α) − x))2 .

Substituting pe⋆ into the opt-in demand, we obtain
x 2f (α) + 2αx + 2xf (α) − x2

4f 2 (α)
e⋆ =
D
S
2


 x − (2x − α − 2f (α) + Γ)f (α)
18f (α)if α < α2 (x),if α ≥ α2 (x).

Similarly, the opt-out and total demands can be calculated as(f (α) − x)(2f (α) + 2αx − x2 ) 2f (α) + 2αx + x2


,


4f 2 (α)
4f (α)

if α < α2 (x),

⋆ e⋆
e

(DN , D ) = (f (α) − x)(3 + 2f (α) + α − 2x − Γ) 6f (α) − (2f (α) + α − 2x − Γ)(x + α − f (α))


,



3f (α)
9f (α)

if α ≥ α2 (x).
e ⋆ and consumer surplus CSg⋆ are given byThen, the firm’s profit Π

2
2
2

e ⋆ = 4f (α) + 4xf (α)(x + 2α + 2αx) + x (x − 2α) ,
if α < α2 (x),
Π

2a
2

16f (α)




2
2
⋆
e
e ⋆ = 9x(2f (α)(1 + f (α)) + α(3 + 4f (α))) − 9f (α)(α + α(1 + f (α)) + f (α)(2 + f (α)) + 4x )
Π = Π
2b

27f (α)3(2x − α + f (α)) + Γ(6f (α) + (α + 2f (α))2 − 4x(α + 2f (α) − x))if α ≥ α2 (x),+27f (α)

g⋆ =
CS


⋆
12f 2 (α) + 3x2 (2α − x)(3x + 2α) + 4xf (α)(6α + x(3 + 4x))


g

CS
=

2a

96f 2 (α)
if α < α2 (x),
2
2
2
3


g⋆ = 81x + 9f (α)(3 − δ) − 9xδ + δ

CS

2b

162f (α)
if α ≥ α2 (x),where δ := Γ − (2(f (α) − x) + α).

I.3Comparing the equilibria before and after the GDPR

Our baseline model corresponds to the case where k = 1. Since f (α) is continuous in k, ourmain results must hold in the limit. As we explained in Section 6.2, we focus on the values of ksuch that f (α)c > x. In the following, we focus on four different values of k ∈ {0.4, 0.6, 0.8, 1},
calculate the profit and consumer surplus for each case, and show that the main insight from19the paper does not change. That is, the GDPR has a positive impact on profit and consumer
surplus when α is small, but a negative impact when α is large. The results presented in Table
8 in Section 6.2 are obtained from these calculations.
First, Figure 20 shows the changes in profit following the GDPR. As shown in the figure,the GDPR has a positive impact on profit for small values of α, but a negative impact when α
is above a certain threshold. This is true for all k ∈ {0.4, 0.6, 0.8, 1}.

(a) k = 0.4(b) k = 0.6(c) k = 0.8(d) k = 1e⋆ − Π
b ⋆.
Figure 20: Comparison of equilibrium profits, ∆Π = Π
Next, Figure 21 shows the changes in consumer surplus following the GDPR. As shown in
the figure, the GDPR has a positive impact on consumer suplus for small values of α, but anegative impact when α is above a certain threshold. This is true for all k ∈ {0.4, 0.6, 0.8, 1}.

20

(a) k = 0.4(b) k = 0.6(c) k = 0.8(d) k = 1g⋆ − CSd⋆ .
Figure 21: Comparison of consumer surpluses, ∆CS = CS

21