The Bright Side of the GDPR:
Welfare-improving Privacy Management∗
Chongwoo Choe†

Noriaki Matsushima‡

Shiva Shekhar§

September 21, 2023

Abstract
We study the GDPR’s opt-in requirement in a model with a firm that provides a digital
service and consumers who are heterogeneous in their valuations of the firm’s service aswell as the privacy costs incurred when sharing personal data with the firm. We show that
the GDPR boosts demand for the service by allowing consumers with high privacy costs
to buy the service without sharing data. The increased demand leads to a higher price
but a smaller quantity of shared data. If the firm’s revenue is largely usage-based rather
than data-based, then both the firm’s profit and consumer surplus increase after the GDPR,
implying that the GDPR can be welfare-improving. But if the firm’s revenue is largely fromdata monetization, then the GDPR can reduce the firm’s profit and consumer surplus.
JEL Classification: D18, D61, K24, L12, L51, L86.
Keywords: GDPR, opt-in, opt-out, privacy management, welfare∗
We thank Joshua Gans, Hooman Hidaji, Ulrich Laitenberger, Barry R. Nault, Markus Reisinger, Tat-How
Teh, Mark Tremblay, Vaarun Vijairaghavan, Chengsi Wang, and participants at the Monash-USC Digital Conference and the seminar at Haskayne School of Business for helpful comments and suggestions. We gratefully
acknowledge financial support from the Australian Research Council (grant number DP210102015) and theJapan Society for the Promotion of Science (KAKENHI grant numbers JP20H05631, JP21H00702, JP21K01452,
JP21K18430, and JP23H00818). Although Matsushima serves as a member of the Competition Policy ResearchCenter at the Japan Fair Trade Commission (JFTC), the views expressed in this paper are solely ours and should
not be attributed to the JFTC. The usual disclaimer applies.
†
Department of Economics, Monash University. Email: chongwoo.choe@monash.edu.
‡
Institute of Social and Economic Research, Osaka University. Email: nmatsush@iser.osaka-u.ac.jp.
§
The corresponding author. Tilburg School of Economics and Management (TiSEM), CESifo Research affiliate. Email: s.shekhar 1@tilburguniversity.edu, shiva.shekhar.g@gmail.com.

1
Electronic copy available at: https://ssrn.com/abstract=4537982

1

Introduction

The European Union (EU)’s General Data Protection Regulation (GDPR) is generally considered to be the most stringent law that governs personal data protection, and is setting a global
standard for privacy regulations.1 Before the GDPR went into effect in 2018, many consumers
had little control over their data in the digital space. For example, privacy regulations such as
the EU’s Data Protection Directive (Directive 95/46/EC) or Australia’s Privacy Act 1988 werebased on principles and guidelines, which were non-binding and not specific enough; nor were
they entirely fit for the digital age. As a result, online businesses collected and processed personal data without providing clear information to consumers as to what data is collected, how
it is used, and with whom it is shared. Data collection was often set as the default option, fromwhich consumers could not easily opt out. The GDPR superseded the EU’s Data Protection
Directive with more specific data protection requirements, stiffer enforcements, and penalties for
non-compliance. In addition, to rectify the opaque data collection process, the GDPR (Article
7, Recital 32) requires businesses to allow consumers to make a “freely given, specific, informed
and unambiguous” consent to the processing of their personal data, with significant penalties
for non-compliance.2 This requirement essentially mandates opt-in consent to data collection.
Evidence shows that opt-in results in much lower levels of participation than opt-out (Johnson
et al., 2002, 2020), which may explain why opt-out was a predominant way businesses obtained
consent before the GDPR.
Although the European Commission has been positive about the overall success of the
GDPR,3 the media’s assessment has been mixed. Positive assessment was based on moreuser control over personal data, transparency, and accountability requirements on data processors, while negative assessment pointed out the complexity and compliance costs, especiallyfor smaller businesses, adverse effects on investment in technology ventures, as well as the
GDPR’s insufficient data protection measures.4
The academic literature has been generally more critical. A number of empirical studies
report adverse effects of the GDPR on businesses such as a decrease in the amount of datacollected (Schmitt et al., 2021; Congiu et al., 2022; Aridor et al., forthcoming) which adversely
affect AI startups and data-based innovation (Bessen et al., 2020; Batikas et al., 2023), dampened incentives to invest in technology ventures (Jia et al., 2021), a decrease in the number ofmobile apps (Janßen et al., 2022), reduced website pageviews and e-commerce revenue (Goldberg et al., 2022), and increased market concentration in websites and web technology services(Schmitt et al., 2021; Peukert et al., 2022; Johnson et al., forthcoming).5 In addition, several
1
Following the GDPR, many countries enacted similar privacy laws or amended existing ones in line with the
GDPR. Examples include the California Consumer Privacy Act (CCPA) and Brazil’s General Data Protection
Law (LGPD) both of which came into effect in 2020, Singapore’s Personal Data Protection Act (PDPA) amended
in 2019, and South Korea’s Personal Information Protection Act (PIPA) amended in 2020, etc.
2
Some of the largest non-compliance penalties are 746 million euros Luxembourg’s privacy watchdog (CNPD)
imposed on Amazon in 2021, 150 million euros on Google levied by France’s privacy watchdog (CNIL) in 2022
and, more recently, 390 million euros Ireland’s Data Protection Commission imposed on Meta in 2023.
3
https://ec.europa.eu/commission/presscorner/detail/en/qanda 20 1166
4
See, for example, “America should borrow from Europe’s data-privacy law,” The Economist, April 5, 2018;“One year on, GDPR needs a reality check,” Financial Times; June 30, 2019, “How GDPR is failing,” Wired,
May 23, 2022.
5
As potential beneficial effects of the GDPR, Godinho de Matos and Adjerid (2022) provide experimental

2
Electronic copy available at: https://ssrn.com/abstract=4537982

theoretical studies show that the GDPR’s opt-in requirement in its current form can be ineffective in allowing consumers to effectively manage their privacy (Choi et al., 2019; Chen, 2022;
Chaudhury and Choe, 2023).
Given the negative assessment summarized above, one may wonder if there is any salutary
effect to the GDPR. After all, if consumers are able to manage their privacy more effectively
thanks to the GDPR, shouldn’t they benefit from it? Or would the potential consumer benefits
be skimmed away by the digital business with market power? How does the GDPR change
total surplus? Answering these questions is the primary purpose of this paper.
We examine the GDPR’s opt-in requirement for data collection in an environment that
we believe incorporates consumer heterogeneity in a richer and more realistic way than in theexisting literature on digital privacy.6 Specifically, we assume that consumers differ in two dimensions, in their preference for the online service under consideration and in the privacy costs
incurred while sharing personal data with the online business. Adding consumer heterogeneity
in privacy costs to otherwise a standard model of privacy regulation is motivated by two factors.
First, growing evidence reports that consumers are highly heterogeneous in their privacy preferences (e.g., Goldfarb and Tucker, 2012; Ghose, 2017; Lin, 2022; Macha et al., forthcoming).
For example, Acquisti et al. (2015) review studies that classify individuals into three privacy
groups: privacy fundamentalists, pragmatists, and unconcerned. Second, given that one of thestated purposes of the GDPR is to enable consumers to better manage their privacy, a model
where all consumers have identical privacy preference is unlikely to yield meaningful insight. Incorporating such multidimensional consumer heterogeneity allows us to study consumer choicein a way that is richer than in the existing literature, which allows us to identify conditions
under which the GDPR can increase or decrease welfare.
We briefly sketch our model. A firm sells an online service to consumers who are heterogeneous along two dimensions, valuation for the service and privacy cost, the latter incurred if a
consumer shares her personal data with the firm when using the service. If a consumer shares
her data with the firm, which we call opt-in as opposed to opt-out, she can enjoy additional
opt-in benefits offered by the firm. The firm can monetize the data, so that it earns revenue
from two sources: sales of its service that depends on the total demand the firm faces andshared consumer data that depends only on the opt-in demand. We call the former usage-based
revenue and the latter data-based revenue. The firm chooses price for its service to maximize
profit, and consumers make decisions to buy the firm’s service and whether or not to share datawith the firm. We compare the equilibria before and after the GDPR.
Our basic assumption is that the GDPR enables consumers to proactively manage theirdigital privacy by requiring the firm to allow consumers to buy its service without sharing theirpersonal data, i.e., opt-out purchase. That is, before the GDPR, consumers must share datawith the firm when buying its service but, after the GDPR, consumers can choose between
opt-in and opt-out purchase. This is clearly a simplifying assumption. Even before the GDPR,
some privacy-conscious consumers may bypass the firm’s data collection, for example, by deleting cookies, using VPNs or privacy-oriented browsers. Likewise, even after the GDPR, someevidence that suggests that the GDPR’s enhanced opt-in requirements may improve welfare by providing better
privacy protection to consumers and allowing firms to better target their marketing communications.
6This literature is reviewed in Section 2.

3
Electronic copy available at: https://ssrn.com/abstract=4537982

consumers may routinely opt in without thinking through the ramifications of their decisions.
However, insofar as more consumers rationally make opt-in decisions after the GDPR, which
we believe is plausible, our main insight should continue to hold.7 In addition, the absence ofstrict enforcement before the GDPR implies that firms could not credibly commit not to gather
data from consumers who choose opt-out.8 The GDPR lends credibility to such a commitment. In short, a key change brought about by the GDPR in our model is privacy management
made available to consumers, who make opt-in decisions by comparing additional benefits fromsharing data with possible privacy costs.9
First, we show that the equilibrium price for the firm’s service increases after the GDPR.
The intuition is as follows. Before the GDPR, some consumers with high privacy costs may not
buy the service because they do not have an option to buy the service without sharing personal
data. After the GDPR, they can participate by choosing opt-out purchase, which expands
demand for the service. This allows the firm to raise price. The additional choice of opt-out
purchase and the higher price will inevitably decrease the opt-in demand, hence the amount ofdata shared, which will erode the firm’s data-based revenue. But the effect of higher price on
data-based revenue is smaller after the GDPR. It is because the firm earns data-based revenue
only from opt-in demand after the GDPR in contrast to total demand before the GDPR. Thatis, the firm’s choice of price is less constrained by data-based revenue after the GDPR. Thisimplies that the firm charges a higher price for its service after the GDPR regardless of the sizeof its data-based revenue.
Our next result relates to how the GDPR changes the equilibrium demand for the firm’s
service. As discussed above, the GDPR expands demand by providing consumers with anadditional choice of opt-out purchase, which we call the demand expansion effect. But it leads
to a higher price for the service, which counteracts the demand expansion effect. If the demand
expansion effect dominates the price effect, then the equilibrium demand increases after the
GDPR; otherwise, it decreases. We show that the effect of the GDPR on the equilibrium
demand hinges on the size of data-based revenue. When the firm’s data-based revenue is not
significant, the firm chooses price for its service close to the monopoly price. As a result, themarket is not sufficiently covered before the GDPR, which leaves significant room for demand
expansion after the GDPR. In this case, the demand expansion effect dominates the price effect,hence the equilibrium demand increases after the GDPR. However, if the firm earns large databased revenue, it chooses a low price for its service, resulting in the market sufficiently covered
before the GDPR. In this case, the price effect dominates the demand expansion effect, implyingthat the demand increase following the GDPR is limited. Moreover, if the price increase after
7

For example, we can consider a model where a fraction of tech-savvy, privacy-conscious consumers make
optimal opt-in decisions, and the rest always opt in. We can think of the GDPR as increasing the fraction of thefirst group of consumers.
8
In the absence of penalty for reneging by the firm, it is a dominant strategy for the firm to monetize data
even if a consumer chooses opt-out. Anticipating this, consumers face only two effective choices: opt-in purchaseor no purchase. That is, the firm’s commitment to making opt-out purchase available is not credible.
9
Another interpretation is that the GDPR allowed firms to credibly exercise second-degree price discrimination
by offering a menu of {(price for the service, no opt-in benefits), (price for the service, positive opt-in benefits)}.
For example, many German news websites offer free access to its content subject to advertising and tracking or a paid subscription without advertising and tracking.
Some examples arehttps://abo.spiegel.de/de/c/microsites/werbefreilesen/abo or https://www.faz.net/faz-net-services/.

4
Electronic copy available at: https://ssrn.com/abstract=4537982

the GDPR is sufficiently large, then consumers with high privacy costs who purchased theservice before the GDPR drop out of the market after the GDPR. As a result, the equilibrium
demand can decrease after the GDPR. Although the effect of the GDPR on the total equilibrium
demand depends on the firm’s data-based revenue, the amount of data collected by the firm
unambiguously decreases after the GDPR, consistent with empirical evidence cited earlier. Thatis, the equilibrium opt-in demand after the GDPR is smaller than the total equilibrium demand
before the GDPR. This is a straightforward consequence of a higher price and more purchase
options made available to consumers after the GDPR.
Next, we show how the firm’s profit changes after the GDPR. As previously alluded to, theeffect of the GDPR on profit also depends on the size of data-based revenue. When the firm’s
data-based revenue is not significant, the higher price and larger demand imply that the firm
earns larger sales revenue after the GDPR. Although its data-based revenue decreases because
the quantity of shared data decreases, the firm earns larger profit because the data-based revenue
is a small part of its profit. On the other hand, the GDPR can erode the firm’s profitability
if its revenue is largely data-based, mainly because the amount of data collected by the firm
is smaller after the GDPR. The implication is that the GDPR’s effect on the firm’s profit
depends on the firm’s business model. The GDPR is likely to benefit usage-driven businesses
such as ride-hailing platforms like Uber or streaming services like Netflix, but hurt data-driven
businesses such as various navigation and weather apps and, to some extent, businesses whose
main revenue source is advertising that leverages user data.
The GDPR’s effect on consumer surplus also hinges on whether the firm’s revenue is largely
usage-based or data-based. In the former case, the GDPR’s demand expansion effect dominates
the price effect. Given that more consumers can participate in the market after the GDPR
while benefiting from more effective privacy management, consumer surplus increases in thiscase. However, when the firm earns significant data-based revenue, the price effect dominates
the demand expansion effect, and the equilibrium demand can decrease. Thus consumer surplus
decreases in this case. Once again, the implication is that the GDPR can benefit consumers inmarkets that are largely service-based, but can hurt consumers when data-based revenue is asignificant part of digital business.
Although the GDPR’s opt-in requirement is the main focus of this paper, the way we describe privacy management made available after the GDPR applies more generally to other
online businesses as well. In many e-retailers such as Target, Walmart, Zara, etc., consumers
can choose to create an account for transaction or check out as a guest without creating an account. By creating an account, consumers share various personal data such as name, residential
address, email address, payment information, etc. with the retailer. The benefits of creating
an account include faster checkout, order tracking, and exclusive deals and promotions. On
the other hand, sharing data with e-retailers can pose privacy risks such as identity theft, data
breaches, cyberstalking, etc. The option to manage privacy is available in other platforms such
as Google and YouTube. Users can choose the incognito mode or delete usage history afterusing services provided by these platforms. Once again, privacy management trades off additional benefits from sharing data against possible privacy risks. The general conclusion from
our analysis is that, for digital businesses that do not rely heavily on data-based revenue, em-

5Electronic copy available at: https://ssrn.com/abstract=4537982

powering consumers to proactively manager their digital privacy can improve firm profitability,
increase consumer surplus, and hence is welfare-improving. But effective privacy managementby consumers can reduce welfare when businesses rely heavily on data-based revenue.10 We
stress that this conclusion applies where consumers can effectively manage their privacy. But
this may not necessarily be the case even after the GDPR, as we discuss in Section 6.4.
The rest of the paper is organized as follows. In Section 2, we review the related literature.
Section 3 presents a simple example that explains some of our key points, followed by thebaseline model. Section 4 analyzes the baseline model and characterizes the equilibria before
and after the GDPR. Section 5 provides our key welfare results. In Section 6, we discuss several
extensions and variations of the baseline model including the correlation between consumer
valuations and privacy costs (Section 6.1), data externalities (Section 6.2), the case where
consumer heterogeneity is only in valuations (Section 6.3), testable hypotheses from our analysis(Section 6.4), and the implications for management (Section 6.5). Section 7 concludes the paper.
The proofs not provided in the main text are relegated to the Appendix.

2

Related Literature

Our work is related to a number of theoretical studies that model some of the key features of
the GDPR and examine the digital business’s optimal strategy and welfare implications. Choiet al. (2019) focus on the GDPR’s opt-in requirement when there are data externalities, andshow that the monopolistic firm can render opt-in regulations ineffective if it can exercise pricediscrimination. In deriving this result, they assume full market coverage, whereas we consider
the case where the firm uses uniform pricing and the market is not fully covered. Fainmesser
et al. (2023) study the digital business’s choice of data collection and data security, and show
how the optimal strategy depends on the digital business’s revenue model, i.e., whether it ismore usage-driven or data-driven. But the digital business’s optimal pricing decision is absent intheir model, nor do consumers explicitly make opt-in decisions. Ke and Sudhir (2023) analyze amodel of behavior-based pricing that endogenizes the consumer’s decision to exercise the rights
to opt-in, data erasure and data portability, and firms can offer personalized products to opt-in
consumers. In their model, data erasure and portability imply that only opt-in decisions arise
in equilibrium.11 Chen (2022) studies socially optimal data collection policy when consumers
differ in privacy costs. Chaudhury and Choe (2023) provide an illustrative example of optimaldata policy when consumers differ in privacy costs and there are multiple data types. Although
not directly related to the GDPR, Campbell et al. (2015) show that a consent requirement inprivacy regulation can tilt the playing field in favor of large generalist firms at the cost of small,
specialist firms, because it imposes a one-off cost on both but consumer data has multiple use in
the former. In addition to the differences already explained above, none of these studies models
multidimensional consumer heterogeneity as we do in this paper.
A large and growing body of literature studies consumers’ privacy choice and the attendant
10

Gopal et al. (forthcoming) also derive a similar conclusion although welfare-reducing effect of privacy management stems from increased third-party data sharing.
11
Cong and Matsushima (2023) also consider data management by consumers in a two-dimensional Hotellingmodel where data collected in one market can be used in another market.

6
Electronic copy available at: https://ssrn.com/abstract=4537982

data externalities (Choi et al., 2019; Ichihashi, 2021, 2023; Acemoglu et al., 2022; Bergemannet al., 2022, etc.).12 A general conclusion from these studies is that opt-in consumers allow thedata controller to infer more information about opt-out consumers, which can lead to excessive
data sharing and raise the cost from privacy breach.13 Once again, the main difference between
these studies and ours is that we explicitly model multidimensional consumer heterogeneity
whereas consumers differ only in one dimension in these studies, e.g., in their valuation of thedigital business’s service (Choi et al., 2019; Bergemann et al., 2022) or in their valuation ofprivacy (Acemoglu et al., 2022; Ichihashi, 2023).
Several studies model multidimensional consumer types as we do in this paper, although theirfocus is different from ours (Anderson and Gans, 2011; Jentzsch et al., 2013; Miklós-Thal et al.,2023). Anderson and Gans (2011) model consumer heterogeneity in preference and disutility
from advertising in the media market. In the oligopoly model of product differentiation in
Jentzsch et al. (2013), consumers differ in brand preference and transportation costs. MiklósThal et al. (2023) study consumers’ privacy choice when each consumer is represented by two
data types, privacy-sensitive data and innocuous data. Methodologically, the way we model
opt-out is close to the choice of ad avoidance in Anderson and Gans (2011). That is, consumers
in our model can choose opt-out purchase to avoid privacy costs although they lose the opt-in
benefits by doing so.

3

Model

3.1

Illustrative example

We start with a simple example that illustrates some of our key results. Consider a firm that
produces its service at zero marginal cost and sells it at price p. There are four consumers
denoted by (vθ , cθ ), θ = H, L, where vθ is the consumer’s valuation of the service and cθ is her
privacy cost incurred when sharing her data with the firm. Let vH = 3, vL = 2, cH ∈ (1/2, 1),
and cL = 0. Then we have vH − cL > vH − cH > vL − cL > vL − cH > 0. Thus efficiency dictatesthat all consumers buy the service. Each consumer has two options when buying the service:
she can buy the service without sharing her data, which we call opt-out purchase; or she can buy
the service while sharing her data, which we call opt-in purchase. When the consumer chooses
opt-in purchase, the firm offers opt-in benefits denoted by  > 0. We assume  is arbitrarily
small and exogenous given,14 and that consumers buy the service when indifferent.
First, suppose the consumer must share her data when she buys the service, i.e., only opt-in
purchase is available. Then there are four possible prices the firm chooses to maximize profit.
If it chooses p1 = vH − cL = 3, then only type-(vH , cL ) consumer buys the service and thefirm’s profit is π1 = 3 − . If the firm chooses p2 = vH − cH = 3 − cH , then type-(vH , cL ) andtype-(vH , cH ) consumers buy the service. The firm’s profit is then π2 = 2(3 − cH − ) > π1 . If
12

For a comprehensive review of the earlier literature on privacy, see Acquisti et al. (2016).
In addition, based on opt-in consumers’ data, sellers can infer preference of opt-out consumers, which can leadto higher prices and create negative pecuniary externalities (Belleflamme and Vergote, 2016; Braghieri, 2019).
14
For clarity of exposition, we assume that the firm cannot extract opt-in benefits through price. Our example
can be easily modified to allow that possibility without changing the main insight. The firm has incentives tooffer opt-in benefits because it can monetize the data. We do not consider data monetization in this illustrative
example. But we incorporate the firm’s data-based revenue in the formal model.
13

7Electronic copy available at: https://ssrn.com/abstract=4537982

the firm chooses p3 = vL − cL = 2, then all but type-(vL , cH ) consumer buy the service, yielding
profit π3 = 6 − 3 > π2 for the firm. Finally, if the firm sets p4 = vL − cH = 2 − cH , then all
consumers buy the service and the firm earns profit π4 = 4(2 − cH − ) < π3 . Thus, the firm
optimally chooses price pb∗ = 2, earns profit πb∗ = 6 − 3, and excludes type-(vL , cH ) consumer.
In this case, total consumer surplus is 2 − cH + 3.
Next, suppose that the consumer has available both options of opt-in and opt-out purchase.
Given the price discount , consumers with low privacy cost (cL ) choose opt-in purchase whenbuying the service. There are two possible prices the firm can charge consumers who choose
opt-out purchase. First, if it charges p1 = vH = 3, then only high-valuation consumers buy theservice: type-(vH , cL ) consumer chooses opt-in purchase and type-(vH , cH ) consumer chooses
opt-out purchase. In this case, the firm’s profit is 6 − . Second, if the firm chooses p2 = 2,
then all consumers buy the service: type-(vH , cL ) and type-(vL , cL ) consumers choose opt-in
purchase while type-(vH , cH ) and type-(vL , cH ) consumers choose opt-out purchase. The firm’s
profit in this case is 8 − 2. Given that  is arbitrarily small, the firm optimally chooses pe∗ = 2,

and earns profit πe∗ = 8 − 2 > π̂ ∗ = 6 − 3. No consumer is excluded in this case and total
consumer surplus is 2 + 2, which is larger than that when consumers do not have an option tochoose opt-out purchase.
The main takeaway from the above example can be summarized as follows. The option topurchase the service without sharing data allows consumers to better manager their privacy. In
the absence of such an option, consumers with high-privacy cost choose not to buy the service
in order to protect privacy. But these consumers can choose to buy the service without sharing
data when they have such an option. Thus, the option to buy the service without sharing data
expands consumer demand, which benefits the firm. The ability to better manage privacy also
benefits consumers as a whole. On the other hand, the total amount of data shared with thefirm decreases when consumers have the option not to share data. In what follows, we present
a model to formally examine these observations and to explore additional implications.

3.2

Baseline model

We consider a digital business that provides online service at zero marginal cost and charges
price p. Consumers are heterogeneous along two dimensions: valuation for the service (v) andprivacy cost (c). As discussed previously, consumer heterogeneity in privacy preference is welldocumented and, as we show in this paper, it allows us to portray a realistic and rich modelof how the GDPR can help boost demand by expanding consumer choice. We assume v andc are independent and are uniformly distributed on the interval [0, 1].15 As in the illustrative
example, consumers face three possible choices: buying the service while sharing data, called
opt-in purchase; buying the service without sharing data, called opt-out purchase; and notbuying the service.16 Denote the mass of consumers choosing opt-in purchase by DS , the massof consumers choosing opt-out purchase by DN , and the total demand for the firm’s service by
D = DS + DN .
15

In Section 6.1, we discuss the case where v and c ar correlated.
By opt-in purchase, we mean more than sharing data with the firm; it also allows the firm to share or selldata to third parties. Likewise, opt-out purchase prevents the firm from selling or sharing personal information
with third parties, as stipulated in the CCPA Section 120.
16

8
Electronic copy available at: https://ssrn.com/abstract=4537982

The firm can further enhance its service by offering additional benefits to consumers whochoose opt-in purchase. We call this opt-in benefits denoted by x ∈ [0, 1].17 The opt-in benefits
include, among others, time saved thanks to faster checkout, exclusive deals and promotions,improved and personalized service, etc. For example, Gerbes, Missouri-based supermarkets,
offer opt-in benefits such as exclusive specials, fuel points, personalized coupons, and online or
in-app ordering for pickup or delivery.18 To focus squarely on the GDPR’s effect on the demand
for the firm’s service, we assume x is exogenously given.
A consumer of type (v, c) ∈ [0, 1] × [0, 1] who chooses opt-in purchase receives utility
US (v, c) := v + (x − c) − p| {z }(1)

net opt-in
benefits

where p is the price charged by the firm and x − c is the opt-in benefits less privacy cost. If a
type-(v, c) consumer chooses opt-out purchase, then her utility is
UN (v, c) := v − p.

(2)

Clearly, the main difference between opt-in and opt-out purchase is that a consumer choosing
opt-in purchase expects the additional opt-in benefits as well as privacy costs. As discussed
in Section 1, a key change brought about by the GDPR is that firms need explicit opt-in
consent from consumers in order to collect data. Our interpretation of this in our model isthat consumers can choose between opt-in and opt-out purchase after the GDPR, although
they cannot choose opt-out purchase before the GDPR. Based on this, we can summarize
a consumer’s decision as follows. Before the GDPR, a consumer buys the firm’s service if
US ≥ 0. After the GDPR, she chooses opt-in purchase if US ≥ max{UN , 0}, opt-out purchase
if UN ≥ max{US , 0}, and no purchase otherwise.
The firm’s revenue comes from two sources. First, the firm earns revenue from sales of
its service. Given the total demand for the firm’s service D(·), the sales revenue is pD(·).
Second, the firm can monetize the data it collects, for example, through selling data for targeted
advertising (Bergemann and Bonatti, 2015), using data for personalized pricing (Choe et al.,2018; Chen et al., 2020), or through product improvement by data-enabled learning (Hagiu andWright, forthcoming). We do not model how the firm monetizes its data and simply assume
that the revenue is exogenously given by α ≥ 0 per unit of consumer data. Given that the firm
collects data from all opt-in consumers whose mass is denoted by DS (·), the firm’s revenue fromdata is αDS (·). Noting that we assume away all costs for the firm, the firm’s profit is given byΠ = pD(·) + αDS (·).
| {z } | {z }salesrevenue(3)

data-based
revenue

Before the GDPR, we have DN = 0, hence D = DS . Therefore, the main difference in thefirm’s profit after the GDPR is the possibility that D > DS . In the baseline model, we assume17
18

Given that the highest possible privacy cost is 1, we consider the nontrivial case where x ≤ 1.
https://www.gerbes.com/i/privacy-policy

9Electronic copy available at: https://ssrn.com/abstract=4537982

x is exogenously given so that the firm chooses only p in order to maximize profit given in (3).
The game proceeds as follows. First, consumers learn their types privately. Next, the firm
posts price, which is followed by consumers’ decisions: before the GDPR, consumers make only
purchase decisions; after the GDPR, they make additional data-sharing decisions. We focus on
the equilibrium where the market is not fully covered. Given the monopolistic firm, full market
coverage seems not only unrealistic but also makes the comparison of pre- and post-GDPR
regimes less interesting. The precise conditions that ensure this will be spelt out as we go on.

4Analysis

4.1

Equilibrium before the GDPR

Since consumers cannot choose opt-out purchase in this case, any consumer who buys the firm’s
service also shares her data with the firm. Thus, consumer utility relevant to her purchasedecision is US (v, c).
A consumer of type (v, c) buys the service if and only if
US (v, c) ≥ 0 =⇒ c ≤ c(v, p) := v + x − p.
In the above, c(v, p) is the privacy cost that makes the consumer indifferent between opt-in
purchase and no purchase given her valuation v and price p. Then, c(1, p) = 1 + x − p is thethreshold value of privacy cost above which no consumers buy the service. Likewise, v(p) := p−x
is the threshold value of consumer valuation for the service, below which no consumers buy theservice. As discussed previously, we focus on equilibrium where the market is not fully covered.
Depending on v(p) > 0 or v(p) ≤ 0, there are two possible cases, as shown in Figure 1. First,
the demand for the case where 0 < v(p) < 1, i.e., x < p < 1 + x, is illustrated in Figure
1a, which we call case 1a. This is the case where some consumers with low valuation for theservice do not purchase the service regardless of their privacy costs. This case arises when theprice is higher than the opt-in benefits. Second, Figure 1b illustrates the demand for the casewhere −1 < v(p) ≤ 0, or x − 1 < p ≤ x, which we call case 1b.19 This is the case where the
opt-in benefits are large enough (x ≥ p) so that all consumers with relatively low privacy costs
purchase the service, regardless of their valuation for the service. But the opt-in benefits are
not too large (x < 1 + p) so that some consumers with high privacy costs and low valuation do
not purchase the service. In case 1b, a subset of consumers along one dimension of consumer
types is fully served, but not along the other dimension. Thus, a case like this is possible only
when consumer types are multidimensional.
19

Note that the restriction x − 1 < p allows the possibility that the firm may choose a negative price sincex ≤ 1 by assumption. This may happen when the firm’s revenue is largely data-based, i.e., large α, in which casethe firm may subsidize consumers’ purchase of its service with a view to monetizing their data.

10
Electronic copy available at: https://ssrn.com/abstract=4537982

1

c

1

c

c(1, p)

−v(p)

0

1

v(p)

v

0

1 + v(p)1v(b) Case 1b: −1 < v(p) ≤ 0(a) Case 1a: 0 < v(p) < 1

Figure 1: Demand before the GDPR
From the above, we can calculate the demand for the firm’s service as20
Z 1 Z c(v,bp)(1 + x − pb)2


dcdv
=


2
b p) = Zv(bp) 0 Z
D(b
Z 1
Z 1
1+v(b
p
)
c(v,b
p
)

(1 − x + pb)2


dcdv +
dcdv = 1 −

2
0
0
1+v(b
p) 0

if x < pb < 1 + x,
(4)
if x − 1 < pb ≤ x.

b p) = (bb p), leading to the following first-order condiThe firm chooses pb to maximize Π(bp + α)D(b
tion.
b p)
∂ Π(b
=
∂ pb

b p)
b p) + p ∂ D(b+D(b| {z }∂ pb| {z }
Margineffect(+)

Volume (−)
effect

b p)
∂ D(b
α
∂ pb
| {z }= 0.

Data Volume (−)
effectApart from the trade-off between classical margin and volume effects the firm faces in choosing
price, the presence of data-based revenue reduces the firm’s incentive to increase price. Thus
the firm will set price lower than the case without the data-based revenue.
Solving the first-order condition for pb, we obtain 1 + x − 2α


3
?
p
pb =
2

 2(x − 1) − α + 6 + (x + α − 1)3

if x < pb? < 1 + x,
if x − 1 < pb? ≤ x.

In the first case, one can verify that pb? > x if and only if α < α1 (x) and pb? < 1 + x always
holds where
α1 (x) := max
1 − 2x
, 0 .
2

(5)

In the second case, we have pb? ≤ x if and only if α ≥ α1 (x) and pb? > x − 1 always holds.21
In addition, given α ≥ 0, both cases are possible if (1 − 2x)/2 ≥ 0 or x ≤ 1/2; otherwise,
only case 1b is possible. The two cases highlight how the firm’s pricing strategy depends on
its business model. When the firm earns large data-based revenue in the sense that α ≥ α1 (x),20
21

We use b to indicate the regime before the GDPR and e for the regime after the GDPR.
It is straightforward to check that the second-order condition is satisfied under these conditions.

11Electronic copy available at: https://ssrn.com/abstract=4537982

the firm chooses a low price for its service (bp∗ ≤ x) to induce more consumers to purchase its
service, which translates into more data before the GDPR. But, when its data-based revenue
is not significant enough (α < α1 (x)), the firm chooses a higher price (bp∗ > x) to increase its
usage-based revenue.
Substituting pb? into the demand, we obtain the equilibrium price and demand as
1 + x − 2α 2(1 + x + α)2


,

3
9
? b?


(b
p , D )=

2(x
−
1)
−
α
+
β
6
− (x + α − 1)2 + (x + α − 1)β


,
3
9
where β :=pif α < α1 (x),(6)
if α ≥ α1 (x),?

b ? and consumer surplus CS
d can be6 + (x + α − 1)2 . The corresponding profit Π

calculated as
3
b ? = 2(1 + x + α)Πif α < α1 (x),
1a
27
b? =
Π
2

Π
b ? = (2(x + α − 1) + β)(6 − (x + α − 1) + (x + α − 1)β) if α ≥ α1 (x).
1b
27

3
?

4(1
+
x
+
α)

d =

if α < α1 (x),
CS

1a

81

?
d = d?
81 + 18(x + α − 1) − 2(x + α − 1)3 − 2(12 − (x + α − 1)2 )β
CS
CS
=

1b

81




if α ≥ α1 (x).

(7)

(8)

The following lemma is a direct consequence of the above discussion.
Lemma 1 In equilibrium before the GDPR, the price and demand are as in (6), and the corresponding profit and consumer surplus are as in (7) and (8), respectively.
• The equilibrium price increases in the opt-in benefits x and decreases in the marginaldata-based revenue α.
• The equilibrium demand, profit, and consumer surplus are all increasing in x and α.
Proof: See the appendix.
The comparative statics results in the above lemma are quite intuitive. First, an increasein the opt-in benefits makes the firm’s service more valuable when consumers choose opt-in
purchase. Given that opt-in purchase is the only choice consumers have when buying theservice before the GDPR, an increase in x expands the demand for the service. This can beseen clearly from Figure 1: an increase in x expands the shaded areas since v(p) = p − xand c(1, p) = 1 + x − p. This allows the firm to charge a higher price and earn larger profit.
Consumer surplus also increases since, given the elastic demand, the firm can extract only partof the additional opt-in benefits through higher price. Next, when α increases, the firm canbenefit more by increasing the volume of data, from which it earns the data-based revenue.
Thus it reduces price to attract more opt-in consumers. As a result, an increase in α decreases
the equilibrium price and increases the equilibrium demand. This implies that consumer surplus
increases when α increases. In addition, since the firm’s equilibrium profit changes in response
12Electronic copy available at: https://ssrn.com/abstract=4537982

to a change in α exactly by the amount of its equilibrium demand, a direct consequence of theenvelope theorem, the firm’s profit also increases when α increases.

4.2

Equilibrium after the GDPR

After the GDPR, a consumer of type (v, c) chooses opt-in purchase if US ≥ max{UN , 0}, opt-out
purchase if UN ≥ max{US , 0}, and no purchase if max{US , UN } ≤ 0. Thus, the set of consumers
choosing opt-in purchase is given by{(v, c) ∈ [0, 1] × [0, 1] | c ≤ v + x − p, x ≥ c},and the set of consumers choosing opt-out purchase is given by{(v, c) ∈ [0, 1] × [0, 1] | v ≥ p, x < c}.
As before, US ≥ 0 leads to the threshold condition, c ≤ c(v, p) = v+x−p. Then, v(p) = p−x
is the threshold value of consumer valuation for the service, below which no consumers choose
opt-in purchase. Next, UN ≥ 0 if v ≥ p, which leads to vN (p) := p, the threshold valueof consumer valuation, below which no consumers choose opt-out purchase. Clearly, we havev(p) ≤ vN (p). In addition, US ≥ UN holds if and only if x ≥ c. Once again, we have two
possible cases where the market is not fully covered, depending on v(p) > 0 or v(p) ≤ 0. These
are depicted in Figure 2, where the area labeled opt-in represents the demand from consumers
who choose opt-in purchase and the area labeled opt-out is the demand from consumers whochoose opt-out purchase. Figure 2a illustrates the demand for case 2a where 0 < v(p) < 1,
i.e., x < p < 1 + x, and Figure 2b shows the demand for case 2b where −1 < v(p) ≤ 0, i.e.,x − 1 < p ≤ x. As expected, the additional opt-out purchase made available by the GDPR
allows consumers to self-select themselves: those with low privacy costs choose opt-in purchasein order to enjoy the opt-in benefits; those with high privacy costs choose opt-out purchase to
avoid the privacy costs.
1

c

1

c
Opt-outx
Opt-outx−v(p)Opt-in0v(p)vN (p)

Opt-in1v

0vN (p)

1v(b) Case 2b: −1 < v(p) ≤ 0(a) Case 2a: 0 < v(p) < 1

Figure 2: Demand after the GDPR
From the above, we can calculate the opt-in, opt-out, and total demands as follows. First,
13
Electronic copy available at: https://ssrn.com/abstract=4537982

the opt-in demand isZ v (ep) Z c(v,ep)
Z 1 Z x
N
x2


dcdv
=
dcdv
+
+ x(1 − pe)


2
vN (e
p) 0
v(e
p)
0
e
DS (e
p) = Z v (ep) Z c(v,ep)
Z 1 Z xN
pe2

dcdv = x −dcdv +

2
vN (e
p) 0
0
0

if x < pe < 1 + x,
(9)
if x − 1 < pe ≤ x.

The expression for the opt-out demand is the same in both cases and is given by
Z 1

Z 1
dcdv = (1 − x)(1 − pe).

e N (e
D
p) :=
vN (e
p)

x

(10)

The total demand is then 2x
 + 1 − pe2e p) = De S (ee N (eD(ep) + Dp) =pe2
1 − (1 − x)ep−2

if x < pe < 1 + x,

(11)

if x − 1 < pe ≤ x.

e p) = peD(ee p) + α D
e S (e
The firm chooses pe to maximize Π(ep). Compared to the problem before
the GDPR, the firm’s profit comes from two different sources. Its revenue from sales depends on
the total demand but the data-based revenue depends only on the opt-in demand. Solving thefirm’s problem, we obtain pe? = (2 − 2αx + x2 )/4 if x < pe? < 1 + x and pe? = (Γ − 2 − α + 2x)/3 ifpx − 1 < pe? ≤ x where Γ := 6 + (2 − 2x + α)2 . In the first case, one can verify that pe? < 1 + x
always holds and pe? > x if and only if α < α2 (x) where
α2 (x) := max


2 − 4x + x2
, 0 .
2x

(12)

In the second case, we have pe? ≤ x if and only if α ≥ α2 (x) and pb? > x − 1 always holds.22 Also,√
given α ≥ 0, both cases are possible if (2 − 4x + x2 )/(2x) ≥ 0 or x ≤ 2 − 2 ≈ 0.585; otherwise,
only case 2b is possible. Put together, we can write the equilibrium price after the GDPR as2(1 − αx) + x2


4
pe? =

Γ
−
(2
−
2x + α)3if α < α2 (x),(13)
if α ≥ α2 (x).

Substituting pe? into the opt-in demand, we obtain
x 2 + 2αx + 2x − x2



4
e? =
D
S

3
+
(2
− 2x + α)2 − (2 − 2x + α)Γ

x −
9
22

if α < α2 (x),(14)
if α ≥ α2 (x).

It is straightforward to check that the second-order condition is satisfied under these conditions.

14Electronic copy available at: https://ssrn.com/abstract=4537982

Similarly, the opt-out and total demands can be calculated as(1 − x)(2 + 2αx − x2 ) 2 + 2αx + x2
if α < α2 (x),
,

4
4
? e?
e

(DN , D ) = (1 − x)(5 + α − 2x − Γ) 6 − (2 + α − 2x − Γ)(x + α − 1)if α ≥ α2 (x).
,
3
9
(15)
?
?
e
g
Then, the firm’s profit Π and consumer surplus CS are

2
2


e ?2a = 4 + 4x(x + 2α + 2αx) + x (x − 2α) ,if α < α2 (x),
Π



16


−27(2 − αx) + 36(1 + 2x − α) − 9(1 + 2x − α)2 + (1 + 2x − α)3e? = e?
Π
Π2b =


27



(15
−
(5
−
2x
+
α)(1
+
2x
− α))Γ

if α ≥ α2 (x),
+
27

2 2
3
4

CS
g?2a = 12 + 24αx + 12(1 + α )x + 4(4 + 3α)x − 9x



96




if α < α2 (x),
g? =
CS
2
2
2
2


g? = δ(δ − 9xδ + 27x ) − 9(10 − 4x + 3x + 2α)δ + 27(5 + 3x )

CS

2b

162




if α ≥ α2 (x),

(16)

(17)

where δ := Γ − (2 − 2x + α). The above analysis leads to the following lemma.
Lemma 2 In equilibrium after the GDPR, the price is as in (13), the opt-in demand, opt-out
demand, and total demand are as in (14) and (15), and the corresponding profit and consumer
surplus are as in (16) and (17), respectively.
• The equilibrium price decreases in x if and only if α2 (x) > α ≥ x. The equilibrium pricedecreases in α.
• Both the equilibrium opt-in demand and total demand increase in x and α. The equilibrium2

opt-out demand increases in x if and only if α2 (x) > α > α3 (x) := 2+2x−3x
2−4x , and always
increases in α.
• Both the equilibrium profit and consumer surplus increase in x and α.
Proof: See the appendix.
The above comparative statics results are similar to those from the case before the GDPR.
For example, an increase in α decreases the equilibrium price and increases the equilibrium
demands, profit, and consumer surplus. One main difference is how the equilibrium priceresponds to a change in the opt-in benefits. Unlike the case before the GDPR, the equilibrium
price can decrease in x when α < α2 (x). This highlights the difference in the firm’s pricing
incentives. Before the GDPR, an increase in x increases total demand, all of which generates
data-based revenue. Therefore, the firm increases price when x increases. After the GDPR, an
increase in x increases opt-in demand but decreases opt-out demand if price stays the same, as
shown in (9) and (10). This can be also seen from Figure 2. Thus, if the firm raises price in
15Electronic copy available at: https://ssrn.com/abstract=4537982

response to an increase in x, there will be a further decrease in opt-out demand, which erodes
the firm’s total revenue. Consequently, when the firm increases price in response to an increase
in x, the firm weighs increased data-based revenue thanks to increased opt-in demand against
reduced usage-based revenue due to decreased opt-out demand. This implies that the firm isless likely to increase price when its data-based revenue is not significant, or α is small.

5

Comparing the Equilibria before and after the GDPR

Our analysis in the previous section shows that different equilibria exist for different values of(x, α). For example, a set of (x, α) may lead to case 1a equilibrium before the GDPR but case 2b
equilibrium after the GDPR. Therefore, in comparing the equilibria before and after the GDPR,
we need to be precise about which pair of equilibria exists for given values of (x, α). Before the
GDPR, we have case 1a equilibrium if α ≤ α1 (x) and case 1b equilibrium if α > α1 (x) where
α1 (x) is given in (5). Since α ≥ 0, case 1a equilibrium exists only if x ≤ 1/2 because α1 (x) = 0 if
x > 1/2. This implies that case 1a equilibrium exists for (x, α) ∈ {(x, α)|α ≤ α1 (x), x ≤ 1/2},
and case 1b equilibrium exists for (x, α) ∈ {(x, α)|α > α1 (x), x ≤ 1/2} or (x, α) ∈ {(x, α)|α >α1 (x), x > 1/2}. Applying a similar argument to the case after the GDPR, we can conclude√
that case 2a equilibrium exists for (x, α) ∈ {(x, α)|α ≤ α2 (x), x ≤ 2 − 2} and case 2b
equilibrium exists for (x, α) ∈ {(x, α)|α > α2 (x)} where α2 (x) is given in (12). In addition, we
can verify α2 (x) ≥ α1 (x), which implies that we cannot have case 1a equilibrium before the
GDPR co-existing with case 2b equilibrium after the GDPR. Based on these discussions, we canidentify a pair of equilibria corresponding to all possible values of (x, α), which we summarize
below.
Lemma 3 A pair of equilibria before and after the GDPR can be fully described as follows:• If x ≤ 1/2 and α < α1 (x), then we have case 1a equilibrium before the GDPR and case2a equilibrium after the GDPR.
√• If x ≤ 2 − 2 and α1 (x) ≤ α < α2 (x), then we have case 1b equilibrium before the GDPR
and case 2a equilibrium after the GDPR.
• If x ≤ 1 and α ≥ α2 (x), then we have case 1b equilibrium before the GDPR and case 2b
equilibrium after the GDPR.
Proof: From the preceding discussions, we can identify three possible pairs of equilibria as
follows. First, if x ≤ 1/2, then we have (case 1a equilibrium, case 2a equilibrium) if α <α1 (x) ≤ α2 (x), (case 1b equilibrium, case 2a equilibrium) if α1 (x) ≤ α < α2 (x), and (case 1b√
equilibrium, case 2b equilibrium) if α1 (x) ≤ α2 (x) ≤ α. Second, if 1/2 < x ≤ 2 − 2, then we
have (case 1b equilibrium, case 2a equilibrium) if α < α2 (x), and (case 1b equilibrium, case 2b√
equilibrium) if α ≥ α2 (x). Third, if 2 − 2 < x ≤ 1, then we have (case 1b equilibrium, case2b equilibrium) for all α. The lemma follows from this.



Our first result is that the equilibrium price for the service increases after the GDPR. It isbecause the GDPR enables consumers to better manage their privacy. For example, consumers
16
Electronic copy available at: https://ssrn.com/abstract=4537982

with high privacy costs who did not purchase the service before the GDPR can choose opt-out
purchase after the GDPR. Specifically, suppose a consumer of type (v, c) did not purchase theservice before the GDPR when the price for the service is p. This implies v + x < p + c.
After the GDPR, the consumer can choose opt-out purchase if v ≥ p. On the other hand, aconsumer who purchased the service before the GDPR will continue to do so at the same priceafter the GDPR; the only difference is that she will choose opt-out purchase if v + x > p + cbut x < c. Put together, we can conclude that, at any given price, the firm faces a weakly
larger demand for its service after the GDPR. This allows the firm to increase price. A higher
price can erode the firm’s data-based revenue by reducing the amount of data shared. But theeffect is smaller after the GDPR because the firm earns data-based revenue only from the opt-in
demand after the GDPR whereas its data-based revenue is from the total demand before the
GDPR. Consequently, the firm is less constrained by data-based revenue after the GDPR. Thus,
it charges a higher price for its service after the GDPR irrespective of the size of its data-based
revenue.
Proposition 1 The equilibrium price is higher after the GDPR, i.e., pe? > pb? .
Proof: See the appendix.
Our next result relates to how the GDPR changes the equilibrium demand. Other things
equal, the GDPR should expand demand because, as explained above, it provides consumers
with an additional choice of opt-out purchase. We call this the demand expansion effect. But
the price increase following the GDPR as shown in Proposition 1 acts as a countervailing force.
If the price effect more than offsets the demand expansion effect, then the GDPR can reduce
the equilibrium demand; otherwise, it will increase the equilibrium demand. When α is small,say α < α1 (x), we have case 1a equilibrium before the GDPR and case 2a equilibrium after
the GDPR. This is the case where the market is not sufficiently covered before the GDPR in
the sense that vb? > 0. Thus, there is significant room for demand expansion. Consequently,
the demand expansion effect dominates the price effect, implying that the equilibrium demand
increases after the GDPR. When α is large in that α ≥ α2 (x), the equilibrium shifts from case
1b equilibrium before the GDPR to case 2b equilibrium after the GDPR. This is the case where
the market is sufficiently covered before the GDPR in the sense that vb? < 0, hence there is notmuch room for demand expansion. In this case, we expect the price effect to dominate and,accordingly, the equilibrium demand decreases after the GDPR.
Although the effect of the GDPR on the total equilibrium demand hinges on the size ofthe firm’s data-based revenue, the effect of the GDPR on the amount of data shared is unambiguously negative. That is, the equilibrium opt-in demand after the GDPR is always smaller
than the total equilibrium demand before the GDPR. The intuition is clear. The additional
choice of opt-out purchase available after the GDPR allows consumers to better manage theirprivacy. Accordingly, some consumers with high privacy costs who purchased the service before
the GDPR can switch to opt-out purchase after the GDPR. This implies that, even when the
GDPR increases the total equilibrium demand, we expect the demand from consumers whochoose opt-in purchase to be smaller than that before the GDPR. As discussed previously, thenegative effect of the GDPR on the amount of data collected is well documented (Schmitt et al.,17
Electronic copy available at: https://ssrn.com/abstract=4537982

2021; Congiu et al., 2022; Aridor et al., forthcoming). We also note that the marginal consumer
with the lowest privacy cost who shares data has a higher valuation for the service after the
GDPR, i.e., ve? > vb? . This follows directly from Proposition 1 since ve? = pe? − x > pb? − x = vb? .
This is more or less consistent with the empirical findings in Aridor et al. (forthcoming) that,
although the GDPR has resulted in a reduction in total cookies, the consumers who continue
to be observed after the GDPR tend to be more valuable to advertisers.23
Proposition 2 Comparing the equilibria before and after the GDPR, we find the following.
e? > Db ?.
• When α < α1 (x), the total demand is larger after the GDPR, i.e., Db ? if and only if α < min{α2 (x), α4 (x)} wheree? > D• When α1 (x) ≤ α < α2 (x), we have D
α4 (x) is the value of α that solves 4β(1 − x − α) + 4α2 + 26xα + 13x2 − 2 − 8(x + α) = 0.
e? > Db ? if and only if α < 1 − x.
• When α ≥ α2 (x), we have D• For all values of α, the opt-in demand after the GDPR is smaller than the total demandb? > De? .
before the GDPR, i.e., D
S• The marginal consumer with lowest privacy cost who shares data has a higher valuation
for the service after the GDPR: ve? > vb? .
Proof: See the appendix.
Proposition 2 can be better understood with help of Figure 3, where vb? = pb? − x and
? =p
e?
b
c? = 1 + x − pb? correspond to the equilibrium before the GDPR, and ve? = pe? − x and veN

correspond to the equilibrium after the GDPR. Since pe? > pb? as shown in Proposition 1, we? .
have vb? < ve? < veN

1

c

1

c

(II)

(IV)

b
c?

x

(I)

?

x − pb(IV)x − pe?

x
(I)
0 vb?

ve?

(III)
?
veN

1

v

(III)
0

?
veN

1

v

(b) Case 2: α1 (x) ≤ α2 (x) ≤ α(a) Case 1: α < α1 (x)Figure 3: Comparison of equilibrium demands
In Figure 3a, we illustrate the total equilibrium demand when α < α1 (x) so that thecomparison is between case 1a equilibrium before the GDPR and case 2a equilibrium after the23

Godinho de Matos and Adjerid (2022) report experimental evidence that suggests an alternative channel
that the GDPR can generate benefits to advertisers. That is, the GDPR can lead to varying amounts of datacollected from different types of data, which can help improve targeting capabilities by advertisers.

18
Electronic copy available at: https://ssrn.com/abstract=4537982

GDPR. Before the GDPR, the total equilibrium demand is represented by the triangle definedby the coordinates (bv ? , 0), (1, 0) and (1, bc? ), that is, the sum of areas labeled (I), (III) and (IV).
In the equilibrium after the GDPR, the opt-out demand is represented by the rectangle defined? , x), (e? , 1), (1, x) ,and (1, 1), i.e., the sum of areas labeled (II) and (IV),by the coordinates (evNvN? , x), (1, 0)
and the opt-in demand is given by the trapezoid defined by the coordinates (ev ? , 0), (evN

and (1, x). Thus, the total demand after the GDPR is the sum of areas labeled (II), (III) and(IV). To summarize this case, the sum of areas labeled (III) and (IV) captures consumers who
buy the service under both privacy regimes, the area labeled (I) represents consumers who dropout of the market after the GDPR, and the area labeled (II) represents consumers who buy theservice only after the GDPR. Proposition 2 shows that the area (II) in case 2a equilibrium islarger than the area (I) in case 1a equilibrium.
These changes in demand can be explained by considering the behavior of four groups ofconsumers. The first group is consumers in area (I), who drop out of the market after the GDPR
because the firm raises its price after the GDPR. They have relatively low valuations for theservice and low privacy costs. Thus, the additional opt-out choice made available by the GDPR
does not have much value for them. The second group is consumers in area (II), who buy theservice only after the GDPR. They have relatively high valuations and high privacy costs. Due
to high privacy costs, they do not buy the service before the GDPR but, after the GDPR, theychoose opt-out purchase. The third group is consumers in area (III), who buy the service underboth privacy regimes and share data as they have relatively low privacy costs (c ≤ x). The
fourth group is consumers in area (IV), who buy the service under both privacy regimes but
choose opt-out purchase after the GDPR due to relatively high privacy costs (c > x). Thus the
GDPR creates winners and losers. The first and third groups of consumers are worse off after
the GDPR. The second group of consumers is better off while the welfare change for the fourthgroup depends on the trade-off between the higher price and better privacy management.
In Figure 3b, we plot the total equilibrium demand when α ≥ α2 (x) so that the comparison
is between case 1b equilibrium before the GDPR and case 2b equilibrium after the GDPR.
Specifically, we illustrate the case with α > 1 − x, where the equilibrium demand before the
GDPR is the sum of areas (I), (III) and (IV), and the equilibrium demand after the GDPR is
the sum of areas (III) and (IV). This is the case where the market is sufficiently covered before
the GDPR so that there is no new demand created after the GDPR. Moreover, as shown in the
figure, the total equilibrium demand decreases after the GDPR because the price increase after
the GDPR is sufficiently high so that consumers with high privacy costs and low valuations
who purchased the service before the GDPR drop out of the market after the GDPR. These
consumers are represented by area (I) in Figure 3b.24
Next, we discuss how the GDPR affects the firm’s profit. When the firm’s revenue does notdepend significantly on data in that α < α1 (x), the GDPR benefits the firm. This is the directconsequence of Propositions 1 and 2 since, when α < α1 (x), both the equilibrium price anddemand increase after the GDPR. As α becomes large, the increase in price can be countered by
the decrease in total demand, making the effect on profit less obvious. But when α is sufficiently
24

The remaining case is the comparison of case 1b equilibrium before the GDPR with case 2a equilibrium after
the GDPR when α1 (x) ≤ α < α2 (x). We omit the discussion for brevity.

19
Electronic copy available at: https://ssrn.com/abstract=4537982

large, the decrease in demand can dominate the price increase. It is because the equilibrium
price decreases in α as shown in Lemmas 1 and 2. The decrease in demand combined with asmall increase in price make the firm worse off when α is large enough.
Proposition 3 Comparing the equilibria before and after the GDPR, we find the following.
e? > Π
b? .
• When α < α1 (x), the firm’s profit is larger after the GDPR, i.e., Π
2a1ae? > Π
b ? if and only if α ≤ min{α2 (x), α5 (x)} where• When α1 (x) ≤ α < α2 (x), we have Π
2a1be? = Πb? .
α5 (x) is the value of α that solves Π
2a1be? > Π
b ? if and only if α2 (x) < α < α6 (x) where α6 (x) is the• When α ≥ α2 (x), we have Π
2b1be? = Π
b? .
value of α that solves Π2b

1b

Proof: See the appendix.
Figure 4 illustrates Proposition 3. In the figure, the blue shaded region labeled ∆Π > 0 is
where the firm’s profit increases after the GDPR and the yellow shaded region labeled ∆Π < 0is where the firm’s profit decreases after the GDPR. The curved line dividing these two regions
is defined by α5 (x) and α6 (x) stated in Proposition 3. The region labeled ‘Reg I’ corresponds
to the case where α < α1 (x), ‘Reg 2’ corresponds to the case where α1 (x) ≤ α < α2 (x), and‘Reg 3’ corresponds to the case where α ≥ α2 (x). As shown in the figure, for given values ofx, the GDPR benefits the firm for smaller values of α but hurts the firm for larger values ofα, with smaller values of x admitting a larger range of α that benefits the firm. It is because,the smaller x is, the larger is the mass of consumers who participate in the market throughopt-out purchase after the GDPR, as can be checked in Figure 2. This leads to a larger demand
expansion effect.
An implication is that the GDPR can benefit digital businesses that earn revenue primarily
from selling services. Examples of such usage-driven businesses include ride-hailing platforms
such as Uber, Lyft, streaming services such as Netflix, Spotify, and, to some extent, online
market places such as Amazon and eBay. But the GDPR can hurt digital businesses whose
revenue is in large part based on data. Such data-driven businesses include various navigation
and weather apps and, to some extent, Google and Facebook whose main revenue source isadvertising that leverages user data.

20
Electronic copy available at: https://ssrn.com/abstract=4537982

e? − Πb?
Figure 4: Comparison of equilibrium profits, ∆Π = ΠThen, how does consumer surplus change after the GDPR? As discussed previously, consumers with low privacy costs are likely to be worse off because of the higher price after the
GDPR, but those with high privacy costs are likely to be better off thanks to better privacy
management. In particular, all consumers with c < x are worse off either because they dropout of the market or because they pay a higher price after the GDPR. On balance, the GDPR
is more likely to increase consumer surplus when α is smaller for the following reasons. First,
when α is small, the equilibrium price before the GDPR is already close to the monopoly level
and, therefore, the price increase following the GDPR is limited. Second, as explained earlier,there is significant room for demand expansion when α is small. Thus the GDPR’s demand
expansion effect is more likely to dominate the price effect for smaller values of α. Put together,
the GDPR’s effect on consumer surplus hinges on (x, α) such that, for smaller value of x, theGDPR can admit a wider range of α for which consumer surplus increases after the GDPR. As
x increases, the benefits from privacy management decrease, implying that the range of α forwhich consumer surplus increases after the GDPR shrinks.
Proposition 4 Comparing the equilibria before and after the GDPR, we find the following.
g?2a > CSd?1a , if• When α < α1 (x), the consumer surplus is larger after the GDPR, i.e., CS
g? = CSd? .
and only if α < α7 (x) where α7 (x) is the value of α that solves CS2a1ag?2a > CSd?1b if and only if α < α8 (x) where α8 (x) is• When α1 (x) ≤ α < α2 (x), we have CS
g?2a = CS
d?1b .
the value of α that solves CS
g? > CSd? if and only if α < α9 (x) where α9 (x) is the value• When α ≥ α2 (x), we have CS
2b
1b
?
?
g
d
of α that solves CS = CS .
2b

1b

Proof: See the appendix.
Figure 5 illustrates Proposition 4. In the figure, the blue shaded region labeled ∆CS > 0 is
where the equilibrium consumer surplus is larger after the GDPR and the yellow shaded region

21
Electronic copy available at: https://ssrn.com/abstract=4537982

labeled ∆CS < 0 is where it is smaller after the GDPR. The line dividing these two regions ismade up of three pieces: the lowermost part corresponds to the case where α < α1 (x) (RegionI) and is defined by α7 (x) stated in Proposition 4; the curve in the middle corresponds to thecase where α1 (x) ≤ α < α2 (x) (Region II) and is defined by α8 (x); and the uppermost part
corresponds to the case where α ≥ α2 (x) (Region III) and is defined by α9 (x).
As shown in the figure, for given values of x, the GDPR increases consumer surplus forsmaller values of α but decreases it for larger values of α. The intuition is straightforward.
When α is small, there is much room for demand expansion, which is realized after the GDPR,
as shown in Proposition 2. The increased consumer participation following the GDPR leads
to larger consumer surplus. When α is large, however, the GDPR does not increase consumer
participation sufficiently enough and, in some cases, even dampens it due to higher price. In
addition, the set of (x, α) that leads to larger consumer surplus is smaller than the set of (x, α)that leads to larger profit, as shown in Figures 4 and 5. This is because the price increase
following the GDPR partially offsets the benefits to consumers. In sum, the implication is that
the GDPR can benefit consumers in markets that are largely service-based, but it can hurt
consumers when data-based revenue is a significant part of digital business.

g? − CSd?
Figure 5: Comparison of consumer surpluses, ∆CS = CS

6

Discussions and Extensions

6.1

Correlation between v and c

Our baseline model assumed that v and c are independent. Depending on digital services, it isconceivable that there could be some correlations between the two. Take social media services,for example. A consumer who actively uses social media services may do so because she does
not perceive the privacy cost to be high, which suggests a negative correlation between v andc.25 The correlation can be positive in medical services and health apps. These services often
require users to share sensitive health data and, therefore, privacy-conscious individuals would25

A study by Pew Research Center (2019) suggests that individuals who are less concerned about privacy are
more likely to share more personal information on social media.

22
Electronic copy available at: https://ssrn.com/abstract=4537982

choose to share such information as they value these services highly. In this section, we allow
correlations between v and c. In particular, we examine two polar cases of perfect positive andperfect negative correlations. The insight from these two cases may be used for extrapolation
in intermediate cases.
 Positive correlation. Suppose c = φv where φ ∈ (0, 1), and assume x < φ so that there
is a positive mass of consumers who opt out after the GDPR, i.e., consumers with x < c = φv,
or v > ve := x/φ. In this case, the GDPR’s demand expansion effect does not exist. The reason
is that, given the perfect positive correlation, consumers who do not buy the service before
the GDPR do not buy the service either after the GDPR. To see this, let vb be the marginal
consumer who buys the service before the GDPR, i.e., vb + (x − φbv ) − p = 0 and [bv , 1] is the total
demand before the GDPR. After the GDPR, the positive correlation between v and c implies
that consumers on [bv , ve] continue to choose opt-in purchase while those on [ev , 1] choose opt-out
purchase. In addition, by the definition of ve and the fact that ve > vb, no consumers outside [bv , 1]
participate in the market through opt-out purchase.
Consequently, the GDPR does not boost demand; it only divides the pre-GDPR total demand into opt-in and opt-out demands. As a result, the equilibrium price does not change
after the GDPR. Given that the equilibrium price and total demand do not change, the firm isworse off after the GDPR. It is because the firm earns data-based revenue only from the opt-in
demand after the GDPR, which is smaller than the total demand because consumers on [ev , 1]
choose opt-out purchase after the GDPR. Finally, consumer surplus increases after the GDPR
because the price stays the same while those choosing opt-out purchase benefit from privacy
management. To summarize, the GDPR can hurt the firm and benefit consumers when v andc are positively correlated. It is worth noting that these results hold regardless of α.
 Negative correlation. Suppose now c = 1 − φv where we set φ = 1 to simplify analysis.
Then, there is a positive mass of consumers who opt out after the GDPR because x > 0. Let
ve = 1 − x be the marginal consumer, who is indifferent between opt-in purchase and opt-out
purchase if ve ≥ p. Then, for all v < ve, we have c = 1 − v > 1 − ve = x. It follows that all
consumers on [p, ve] choose opt-out purchase. That is, the negative correlation between v andc implies that consumers who choose opt-out purchase are those with lower valuations, hence
higher privacy costs, than ve, which is in contrast to the case with positive correlation. Thisimplies that the GDPR can expand demand by inducing participation by consumers with low
valuations who would not have opted in before the GDPR. More specifically, since consumers
with low valuations choose opt-out purchase, the total demand after the GDPR is given by
D(p) = 1 − p, which is independent of x. On the other hand, the demand before the GDPR
increases in x. Thus, the GDPR’s demand expansion effect depends on x: the GDPR is more
likely to expand demand when x is smaller and decrease it when x is larger. To summarize,
when v and c are negatively correlated, the GDPR’s welfare effects depend on x and α, in
contrast to the case with positive correlation.
Proposition 5 Suppose v and c have a perfect positive correlation given by c = φv, φ > x,
φ ∈ (0, 1) and assume α < 1 + x − φ which ensures that the equilibrium price is positive. Then,comparing the equilibria before and after the GDPR,
23
Electronic copy available at: https://ssrn.com/abstract=4537982

• the price and demand are the same;• the firm’s profit is smaller but the consumer surplus is larger after the GDPR.
Suppose v and c have a perfect negative correlation given by c = 1 − v and assume α < 1 + x
which ensures that the equilibrium price is positive. Then, comparing the equilibria before andafter the GDPR,• the price is higher after the GDPR if and only if α > x;
• the total demand is larger after the GDPR if and only if α < 1 − x;
• there are threshold values αL and αH with αL < αH such that the profit is larger after the
GDPR if and only if max{0, αL } < α < min{αH , 1 + x};• there is a threshold value αCS such that the consumer surplus is larger after the GDPR if
and only if α < min{αCS , 1 + x}.
Proof: See the appendix.

6.2

Data externalities

A consumer’s data-sharing decision can impose several types of externalities on others. First,
consumers using the firm’s service may enjoy network benefits that increase as more consumers
share data with the firm (Hagiu and Wright, forthcoming). For example, online retailers suchas Amazon and Etsy rely on various user-generated data including product reviews and ratings
to provide valuable information to consumers. Network benefits may also include improved
products and services that sellers on the marketplaces can provide based on customer feedback.
Second, data sharing by some consumers can impose negative externalities in the form of larger
privacy costs on others who do not share data (Choi et al., 2019; Ichihashi, 2021; Bergemannet al., 2022; Miklós-Thal et al., 2023). For example, some people’s shared data can be used toinfer information about others who do not share data. As more data is shared, the inference canbe improved through machine learning, which leads to larger privacy costs. As another example,
hackers can use personal data obtained from one group of users to craft convincing phishingemails or other social engineering attacks targeted at another group of users. Third, there canbe negative pecuniary externalities whereby the firm can use the data on opt-in consumers toinfer information on and charge higher price to opt-out consumers (Belleflamme and Vergote,
2016; Braghieri, 2019). In this section, we consider the first two, positive network benefits andnegative data externalities, and discuss how our main results may change.
 Positive network benefits. Denote network benefits by θDS where θ ≥ 0 is an exogenously
given value accruing from an additional data-sharing consumer. We assume that network benefits are enjoyed by all consumers that buy the service whether or not they share data with thefirm. For example, even if a consumer makes a purchase at an online shop without creating an
account, she can still read all the reviews and ratings. Thus, the main difference between opt-in

24Electronic copy available at: https://ssrn.com/abstract=4537982

and opt-out purchase is that a consumer choosing opt-in purchase expects additional opt-in
benefits as well as privacy costs, which is the same as in the baseline model.
When there are network benefits, a consumer’s opt-in decision depends on her expectationon the mass of opt-in consumers, which we denote by DSe . Then, a consumer of type (v, c)derives expected utility

U (v, c, DSe ) =U := v + (x − c) + θDSe − p, S
U := v + θDSe − p, NU := 0,Owith opt-in purchase,with opt-out purchase,
without purchase.

As is clear from the above, consumers are more likely to purchase the firm’s service because bothUS − UO and UN − UO increase by θDSe compared to the case without network benefits. But
network benefits do not affect their opt-in decisions since US − UN is the same with or without
network benefits. Given that the GDPR’s main effect in our model is to allow consumers tomake opt-in decisions proactively, we expect our key insight from the baseline model to remainunchanged.
 Negative data externalities. Suppose negative data externalities are proportionate to theconsumer’s privacy cost and the expected mass of opt-in consumers, DSe . Let γ ≥ 0 represent themagnitude of negative externalities, so that consumer (v, c) suffers total negative externalities
equal to γcDSe . We can consider two possible ways negative externalities can be introduced tothe baseline model. First, suppose negative externalities affect all consumers including those
who share data, as in Choi et al. (2019). In this case, all consumers’ utility decreases by γcDSe ,whether they choose opt-in purchase, opt-out purchase, or no purchase. Consequently, theanalysis is exactly the same as before.
Suppose now that negative externalities affect consumers who do not share data, whether
or not they buy the service. Then, consumer (v, c) derives utilityU := v + (x − c) − p, Se
U (v, c, DS ) = UN := v − γcDSe − p,
U := −γcDe ,OSwith opt-in purchase,with opt-out purchase,
without purchase.

As is clear from the above, negative externalities make opt-in a more attractive choice than
opt-out: compared to the baseline model, US − UN increases by γcDSe . In addition, US − UO
also increases by γcDSe but UN − UO stays the same. Put together, we can conclude thatnegative externalities increase the proportion of consumers who choose opt-in purchase. Thisdiminishes the value of an option to choose opt-out purchase, which dampens the effect of the
GDPR. But our key insight does not change because the main mechanism that the GDPR cancreate more demand remains intact even in the presence of negative externalities. That is, theGDPR allows consumers with large privacy costs who stay out of the market before the GDPR
to participate in the market through opt-out purchase; negative externalities reduce, but noteliminate, the proportion of such consumers. In addition, by making opt-in a more attractive
choice than opt-out, negative externalities also reduce the proportion of consumers who exit the

25
Electronic copy available at: https://ssrn.com/abstract=4537982

market after the GDPR because of the high price.

6.3

When consumers differ only in valuations of the service

One of our key results is how the GDPR leads to a substitution between data quantity and thee? < Db ? but ve? > vb? . This result depends
value of data as summarized in Proposition 2, i.e., DS

crucially on consumer heterogeneity in privacy costs. To verify this claim, we briefly discuss
the case without consumer heterogeneity in privacy costs. Suppose c is constant and denotez := x − c so that consumer type is represented by v only.
Before the GDPR, consumer v buys the service if v ≥ p − z, hence D = 1 − (p − z).
b ? = (1 + z + α)/2. After the GDPR,
Maximizing Π = (p + α)D gives us pb? = (1 + z − α)/2 and D
we have two cases. First, if z ≥ 0, then there is only opt-in purchase, implying that the outcome
is the same as that before the GDPR. In this case, the GDPR has no effect on the amount ofdata shared. Second, if z < 0, then there is only opt-out purchase. Then D = DN = 1 − p ande ? = 1/2 and D
e ? = 0.
DS = 0. Maximizing Π = pD + αDS leads to pe? = D
SComparing the above and noting that z < 0 in this case, we find pe? > pb? always holds ande? > Db ? if and only if α + z < 0. That is, the equilibrium price increases after the GDPR, andD
the equilibrium demand increases if and only if α < c − x. It is also straightforward to checkthat the equilibrium profit increases after the GDPR if and only if α < c − x. But the quantityof shared data either does not change or decreases to zero. Thus, there is no possibility that the
GDPR reduces the quantity of data while increasing the marginal consumer’s valuation for thefirm’s service. This is intuitively clear since, in the absence consumer heterogeneity in privacy
costs, there is no sense in which the GDPR can invite consumers with high privacy costs tochoose opt-out purchase.

6.4

Testable hypotheses

In this section, we summarize testable hypotheses that can be derived from our analysis anddiscuss the issues relevant to testing these hypotheses.
Our main hypotheses can be summarized as follows. First, for digital businesses whose main
revenue source is selling service, empowering consumers to make informed and proactive decisions for data sharing can increase price for the service, consumer activity, business profitability,
and consumer surplus. Second, for digital businesses whose main revenue source is data which iscollected through selling service, more effective privacy management by consumers can increaseprice for the service, but decrease consumer activity, business profitability, and consumer surplus. As discussed earlier, the examples of usage-driven businesses include various ride-hailing
platforms and streaming services and, to some extent, online market places, while data-driven
businesses include various navigation and weather apps and, to some extent, digital platforms
whose main revenue source is advertising that leverages user data.
There is an important caveat in testing the above hypotheses. Our model assumes fullyinformed consumers who can rationally choose between opt-in and opt-out purchase after the
introduction of new privacy regulations, the GDPR being the focus of our paper. However, one
may argue that, even after the GDPR, consumers’ ability to manage privacy may be hampered
for various reasons. First, the GDPR’s cookie rules are not refined enough, which has led
26Electronic copy available at: https://ssrn.com/abstract=4537982

to a proliferation of diverse consent management platforms and failed to enable consumers
to effectively manage their privacy (Chen, 2022; Chaudhury and Choe, 2023). Second, many
websites continue to rely on dark patterns, implied consent, and various forms of nudging to
influence consumers’ data sharing decisions (Utz et al., 2019; Machuletz and Böhme, 2020; Matteet al., 2020; Nouwens et al., 2020). Third, consumers generally show apathy toward complex
and long privacy notices and select the ‘quick join’ clickwrap to gain access to a website (Obarand Oeldorf-Hirsch, 2020).
In view of the above issues, the GDPR’s welfare implications analyzed in this study need
to be understood to apply to an environment where the GDPR achieves its stated purpose of
enabling consumers to make an informed and unambiguous consent to data sharing. However,identifying GDPR-compliant consent management platforms that are quarantined from theabove compounding factors can be challenging. It can also lead to a selection bias. Therefore,
our hypotheses may be best tested in carefully designed experiments.

6.5

Implications for management

Our analysis generates at least two clear implications for management relevant to digital businesses with some market power. First, empowering customers in privacy management canbenefit the business that does not rely heavily on data-based revenue. As we have shown,active privacy management can expand demand as privacy-conscious consumers can choose
from multiple options to buy the service. This allows the business to raise price if it has somemarket power. The implication is that, even in jurisdictions without the GDPR-type opt-in
requirements, businesses may consider proactively empowering customers in privacy management. After all, today’s savvy consumers can, with a little research, find the information theyneed to make informed decisions. Providing them upfront with clear information and available
options can also minimize potential backlash and reduce customer churn.
Second, we have identified potential conflicts between the usage-based revenue and databased revenue. As the size of data-based revenue grows, the business has an incentive tolower price to attract more consumers and hence more data. This can erode the usage-based
revenue. One possible way to manage such conflicts is to separate the two revenue sources
into independent businesses. For example, a firm that provides advertising services can have aseparate entity responsible for collecting and monetizing user data. Of course, this is subject
to usual considerations relevant to corporate restructuring.26 The establishment of Alphabet
in 2015 may be understood in this context. Alphabet was formed as a holding company thatoversees several separate businesses including Google. This separation allowed Google to focus
on its core search and advertising business while giving other Alphabet subsidiaries such as
Life Sciences and Calico greater autonomy to pursue their own initiatives.27 Another example
involves Twitter and Gnip, an independent social media API aggregation company. Twitter
had a data licensing agreement with Gnip in 2010 for selling access to Twitter’s data to othercompanies. This allowed Twitter to focus on its core business of providing a social media
26

Management accounting can also play a crucial role by developing performance measures based on which toprovide incentives to each revenue center in a way that can mitigate such conflicts.
27
See a blog post by Larry Page, Google’s co-founder, https://blog.google/alphabet/google-alphabet/.

27
Electronic copy available at: https://ssrn.com/abstract=4537982

platform while giving Gnip the freedom to focus on monetizing Twitter’s data.28

7Conclusion

This paper has studied the GDPR’s opt-in requirement in a simple model with a monopolistic
firm and consumers who differ in both valuations of the firm’s service and privacy costs. The
firm’s revenue comes from two sources: sales of its service which we call usage-based revenue,
and monetization of data which we call data-based revenue. Our basic assumption is that
consumers can choose to buy the service without sharing data, called opt-out purchase, only
after the GDPR. Relaxing this assumption will not alter our main insight, as long as moreconsumers proactively manage their privacy after the GDPR, the latter supported by various
empirical and experimental studies.
We have shown that the GDPR expands demand for the firm’s service by inviting consumers
with high privacy costs to participate in the market through opt-out purchase. This allows thefirm to raise price for its service. If the firm’s revenue is largely usage-based, then the equilibrium
demand also increases despite the higher price. In this case, the firm benefits from the GDPR
thanks to the higher price and larger demand. Consumer surplus also increases mainly due tothe increased consumer participation in the market through privacy management. On the other
hand, some consumers with high privacy costs and high valuations who bought the service
before the GDPR can switch to opt-out purchase after the GDPR. This leads to a smaller
quantity of shared data, which erodes the firm’s data-based revenue. Thus, the firm’s profit candecrease after the GDPR if its revenue is largely data-based. Moreover, the higher price after
the GDPR can lead some consumers with low valuations to drop out of the market after the
GDPR, decreasing consumer surplus as a result. Put together, we conclude that the GDPR
has differing effects on the firm and consumers, depending on the firm’s revenue structure. For
the firm without significant data-based revenue, the GDPR can increase profits and consumer
surplus, and hence can be welfare-improving. But it can decrease welfare when data-based
revenue is significant for the firm.

Appendix
Proof of Lemma 1.
First, note that ∂β/∂x = ∂β/∂α = |x + α − 1|/β ∈ [0, 1). Differentiating the equilibrium
price with respect to x, we have1
if α < α1 (x),∂ pb?  3 > 0  = 2 1 ∂β∂x
 +> 0 if α ≥ α1 (x).
3 3 ∂x
28

Twitter eventually acquired by Gnip in 2014 to expand its own data analytics capabilities.

28
Electronic copy available at: https://ssrn.com/abstract=4537982

Differentiating the equilibrium price with respect to α, we obtain2− < 0if α < α1 (x),3 =
1 1 ∂β∂α− +< 0 if α ≥ α1 (x).
3 3 ∂α∂ pb?

Differentiating the equilibrium demand with respect to k ∈ {α, x}, we obtain
4(1 + x + α)>0
if 0 < α < α1 (x),= (1 − x9− α + β)2∂k> 0 if α ≥ α1 (x).
9β

b?
∂D

Given that both the equilibrium price and demand increase in x, it follows that the firm’s
equilibrium profit also increases in x. Next, differentiating the equilibrium profit with respect
to α, we obtain 2(1 + x + α)2
b? 
>0
∂Π
9
=

∂α
 5 + (x + α)(2 − x + β − α) − β > 09if α < α1 (x),if α ≥ α1 (x).

To show the second inequality above, let γ := x + α and write the numerator as F (γ) :=5 + γ(2 + β − γ) − β. Noting that ∂β/∂γ = (γ − 1)/β, we have F 0 (γ) = (1 − γ + β)2 /β > 0. Next,√
solving F (γ) = 0, we find a unique solution γ = 1 − 2 < 0. Thus, we must have F (γ) > 0 for
all γ > 0, which proves the second inequality above.
Differentiating the consumer surplus with respect to k ∈ {α, x}, we have4(1 + x + α)2


>0
d
∂ CS
27

= F (γ) 
1−γ

∂k

1+
>0
54
β
?

if α < α1 (x),if α ≥ α1 (x).

The second inequality above follows from the fact that F (γ) > 0 for all γ > 0 as shownp
previously, and β = 6 + (1 − γ)2 > |1 − γ|.
Proof of Lemma 2.
Differentiating the equilibrium price with respect to x gives usx−αif α < α2 (x),


?
2
!
∂ pe
= 2
2 − 2x + α∂xif α ≥ α2 (x).
3 1 − p
6 + (2 − 2x + α)2
The first derivative is negative if and only if x < α. The second derivative is always positivep
because 0 ≤ 2 − 2x + α < 6 + (2 − 2x + α)2 .

29Electronic copy available at: https://ssrn.com/abstract=4537982

Differentiating the equilibrium price with respect to α, we obtainx
if α < α2 (x),
− <0


?
2
!
∂ pe
=
− 1 1 − p 2 − 2x + α∂α< 0 if α ≥ α2 (x).
 3
6 + (2 − 2x + α)2
Differentiating the equilibrium opt-in demand with respect to x leads to
2 + 4x − 3x2 + 4xα
>0if α < α2 (x),
e?
∂D
S
4

= 1
12

∂x

9 + 4(2(1 − x) + α) +− 4Γ) > 0 if α ≥ α2 (x)9Γp
6 + (2 − 2x + α)2 . The first inequality above holds because x ∈ [0, 1]√
and α ≥ 0. To prove the second inequality, define z := 2 − 2x + α ≥ 0, hence Γ = 6 + z 2 . Let√
12G(z) := 9 + 4z + √6+z
− 4 6 + z 2 . Solving G(z) = 0, we obtain a unique solution z̃ ≈ −0.826.
2
where we recall Γ :=In addition, we can check G0 (z̃) ≈ 0.65 > 0. These two imply G(z) > 0 for all z ≥ 0.
Differentiating the equilibrium opt-in demand with respect to α, we have 2x > 02=2∂α (2 − 2x + α − Γ) > 0
9Γ

e?
∂D
S

if α < α2 (x),if α ≥ α2 (x).

Differentiating the equilibrium opt-out demand with respect to x, we obtain 2
3x − 2x − 4xα + 2α − 2if α < α2 (x),
4


= 1
(2 − 2x + α)∂x
−5 + 2x − α + Γ − 2(1 − x) 1 −if α ≥ α2 (x).
3
Γ

e?
∂D
N

First, consider the case where α < α2 (x). Recall that this case is possible when α2 (x) > 0, or√√
x < 2 − 2 ≈ 0.58, hence the relevant parameter range is A := {(x, α) ∈ R+
2 |x < 2 − 2, α <e ? /∂x = 0 for α yields α3 (x) := (2 + 2x − 3x2 )/(2 − 4x) and we have
α2 (x)}. Solving ∂ DN√
α3 (x) < α2 (x) when x < −4 + 3 2 ≈ 0.24. In addition, limx→1/2 α3 (x) = ∞ and α3 (x) < 0 if√
1/2 < x < 2 − 2. Let G(α) := 3x2 − 2x − 4xα + 2α − 2. Then G0 (α) ≥ 0 iff x ≤ 1/2. Based√on the above, we can consider by dividing A into three regions: (i) If x < −4 + 3 2 < 1/2,
then we have α3 (x) < α2 (x) and G0 (α) > 0, hence G(α) > 0 for all α3 (x) < α < α2 (x); (ii)√
If −4 + 3 2 ≤ x < 1/2, then we have α3 (x) ≥ α2 (x) and G0 (α) > 0, hence G(α) ≤ 0 for all√
α < α3 (x) < α2 (x); (iii) If 1/2 < x < 2 − 2, then α3 (x) < 0 and G0 (α) < 0, hence we haveG(α) < 0 for all α3 (x) < α < α2 (x). From these, we can conclude that, if α < α2 (x), thene ? /∂x > 0 if and only if α3 (x) < α < α2 (x). Consider next the case where α ≥ α2 (x).
∂DNe ? /∂x with respect to x leads toDifferentiating ∂ DNe?
∂2D
4(6(1 − x) + Γ2 )(Γ − (2 − 2x + α))
N
=
>0
∂x2
3Γ3
p
where the inequality follows because Γ := 6 + (2 − 2x + α)2 > 2 − 2x + α and x ≤ 1. At

30
Electronic copy available at: https://ssrn.com/abstract=4537982

e ? /∂x = (−3 − α +x = 1, we have ∂ DN√

e ? /∂x < 0 for
6 + α2 )/3 < 0. Thus we have ∂ DN
e ? /∂x > 0 if and only if
all x ≤ 1. Combining the above two cases, we have shown that ∂ DNα3 (x) < α < α2 (x).
Differentiating the equilibrium opt-out demand with respect to α, we havex(1 − x)>0
if α < α2 (x),

e?
2
∂D
!
N
= (1 − x)
2 − 2x + α

∂α

1− p
> 0 if α ≥ α2 (x).
 3
6 + (2 − 2x + α)2
Differentiating the equilibrium total demand with respect to x leads tox + α > 0e? ∂D= 142+ 8x2 + α(2 − α) − 2x(8 + α) − Γ(4 − 4x − α)

∂x

9Γ

if α < α2 (x),if α ≥ α2 (x).

Analytically evaluating the sign of the second derivative is demanding. Instead, we numericallye ? /∂x and plot the range of (x, α) for which ∂ D
e ? /∂x > 0. We find that
calculate the value of ∂ D
e ? /∂x > 0 for all (x, α) ∈ B := {(x, α) ∈ R+ |x ≤ 1, α ≥ α2 (x)}, that is, the entire range of α∂D
2in this case.
Differentiating the equilibrium total demand with respect to α, we have

x

 >0
= 82 + 2x2 + α(5 + 2α) − Γ(1 + 2α − x) − x(4 + 5α)

∂α

9Γ

e?
∂D

if α < α2 (x),if α ≥ α2 (x).

For the sign of the second derivative, we again rely on the numerical method and verify thate ? /∂α > 0 for all (x, α) ∈ B.
∂D
Comparative statics of the equilibrium profit and consumer surplus can be done in the same
way as that for the equilibrium total demand. So we omit the proof. For the case α < α2 (x),e ? /∂x > 0, ∂ Πe ? /∂α > 0, ∂ CS
g? /∂x > 0, and ∂ CS
g? /∂α > 0. For the case
it is easy to check ∂ Πα ≥ α2 (x), we can use the numerical method to verify that all the derivatives are positive forall (x, α) ∈ B.
Proof of Proposition 1.
Based on Lemma 3, we can calculate the difference in the equilibrium prices before and after
the GDPR as follows:
2 + 8α − x(4 + 6α − 3x)




122

pe? − pb? = 14 + 4α + 3x − 8x − 6xα − 4β

12



Γ − β3if α < α1 (x),if α1 (x) ≤ α < α2 (x),if α2 (x) ≤ α.

Consider the case where α < α1 (x). This case is possible when x ≤ 1/2, which implies
2 + 8α − x(4 + 6α − 3x) > 0. Thus we have pe? > pb? . Moreover, x ≤ 1/2 implies ∂∆p∗ /∂α > 0.
√
Consider next the case where α1 (x) ≤ α < α2 (x), which is possible when x < 2− 2. We will

31
Electronic copy available at: https://ssrn.com/abstract=4537982

show pe? > pb? . Denote the numerator of pe? − pb? by F (x, α). First, note that ∂F (x, α)/∂x < 0√because ∂F (x, α)/∂x = 6(x − α) − 8 − 4(∂β/∂α) and x < 2 − 2, α ≥ 0, and ∂β/∂α >0. Having established ∂F (x, α)/∂x < 0, it suffices to show that, for all α ∈ [α1 (x), α2 (x)),
we have F (x, α) ≥ 0 for the maximum possible value of x for given α, which we denote byx(α). We can derive x(α) by solving α = α2 (x). Since x ∈ [0, 1], we have x(α) = (2 + α) −pp2 − 2. Calculating F (x(α), α), we have F (x(α), α) = 4(2(2 + α) − ( (2 + α)2 − 2 +
(2
+
α)
q
p
9 − 2(1 + 2α) (2 + α)2 − 2 + α(8 + 5α))). In the following, we show that F (x(α), α) > 0.
First, solving F (x(α), α) = 0, we obtain two solutions α = −1/2 and α = −1/6. Next, we
can calculate (∂F (x(α), α)/∂α) |α=−1/6 = 72/35 > 0. This inequality is sufficient to show
F (x(α), α) > 0 for all α > 0 since F (x(α), α) = 0 has only two solutions α = −1/2 andα = −1/6 > −1/2.
Finally, for the case α ≥ α2 (x), recall Γ =p

6 + (2(1 − x) + α)2 and β =p
6 + (1 − x − α)2 .

Thus, we have Γ > β, hence pe? − pb? > 0.
Proof of Proposition 2.

Comparing the equilibrium total demands before and after the

GDPR, we have22
 10 + x − 16x − 2α(8 − x) − 8α



36 2

4β(1
−
x
−
α)
+
4α + 26xα + 13x2 − 2 − 8(x + α)?
?
eb
D −D =
36
(1 − x − α)(3(1 − x) + β − Γ)9if α < α1 (x),if α1 (x) ≤ α < α2 (x),if α2 (x) ≤ α.

Consider the case where α < α1 (x) = (1−2x)/2, when we have α ≤ 1/2 and x ≤ 1/2. Denotee? − Db ? by H(x, α). Given α ≤ 1/2 and x ≤ 1/2, we have ∂H(x, α)/∂x =the numerator of D2(x+α−8) < 0 for all (x, α). We will show that H(x, α) ≥ 0 for all (x, α). Since ∂H(x, α)/∂x <0, it is sufficient to show H(x, α) ≥ 0 for the maximum possible value of x given α for allα ≤ 1/2. Such x solves α = α1 (x), hence x = (1 − 2α)/2. By direct calculation, we havee? ≥ Db ? ifH((1 − 2α)/2, α) = (9 − 36α2 )/4 ≥ 0 since α ≤ 1/2. Thus we have shown D
α < α1 (x).
Consider next the case where α1 (x) ≤ α < α2 (x). Analytically evaluating the sign of?
eb ? is quite demanding. Instead, we numerically calculate its value for all (x, α) such
D −Dthat α1 (x) ≤ α < α2 (x). In Figure 6, the straight line in the lower border of the shaded area
corresponds to α = α1 (x) and the curved line in the upper border is α = α2 (x). Thus, Figure
6 shows how the set {(x, α)|x ∈ [0, 1], α1 (x) ≤ α < α2 (x)} is divided into two regions. The
region labeled ∆D > 0 is where the equilibrium demand is larger after the GDPR and the arealabeled ∆D < 0 is where the equilibrium demand is smaller after the GDPR. The curved linee? = Db ? , which defines α4 (x).
that divides the two areas is where D

32
Electronic copy available at: https://ssrn.com/abstract=4537982

Figure 6: Comparison of total equilibrium demands when α1 (x) ≤ α < α2 (x)Finally, consider the case where α ≥ α2 (x), which is possible for all x ≤ 1. First, we establishthat G(x, α) := 3(1 − x) + β − Γ is always positive. Differentiating G(x, α) with respect to x
yields|x + α − 1| 2(2 − 2x + α)∂G(x, α)= −3 +
+
.
∂x
β
Γ
p
p
Recall β = 6 + (x + α − 1)2 and Γ = 6 + (2 − 2x + α)2 . Thus we have |x + α − 1|/β < 1
and (2 − 2x + α)/Γ < 1, hence ∂G(x, α)/∂x < 0. Next, we have G(1, α) = 0, which implies
G(x, α) > 0 for all x < 1 since x = 1 is the maximum possible value of x and ∂G(x, α)/∂x < 0.
e? − Db ? is the same as the sign of (1 − x − α), from which follows D
e? ≥ Db?
Thus, the sign of D
iff 1 − x ≥ α.
e? < Db ? for all α. By direct calculation, we have
Next, we show DS
9x3 + 8(1 + α)2 − x(2 − 16α) − 2x2 (5 + 9α)



−


36


3 + 4(5 − α2 − β + α(2 + β)) − 2x(x(11 + 9α) + 5 + 4α − 2β)
9x
?
?
e −D
b = −
D
S

36




12 + 3x2 − β − x(15 + 6α − β − 2Γ) − 2Γ + α(6 + β − Γ)−9if 0 < α < α1 (x),if α1 (x) ≤ α < α2 (x),if α2 (x) ≤ α.

e? − Db ? )/∂α < 0 since x < 1/2 inConsider the case where α < α1 (x). It is easy to see ∂(DS
e? − Db ? < 0 when α = 0. Thus we have D
e? < Db ? . For the other two
this case. Moreover, DSS

e? − Db ? and plot the range of (x, α) for whichcases, we numerically calculate the value of DSe? < Db ? . When α1 (x) ≤ α < α2 (x), we find that D
e? < Db ? for all (x, α) ∈ {(x, α) ∈ R+ |x <
D
2
S
S
√
2 − 2, α1 (x) ≤ α < α2 (x)}, i.e., the entire range of α in this case. When α ≥ α2 (x), we finde? < Db ? for all (x, α) ∈ {(x, α) ∈ R+ |x ≤ 1, α2 (x) ≤ α}, i.e., the entire range of α in thisthat DS

2

case.
Proof of Proposition 3. First, when α < α1 (x), the difference in equilibrium profits can be

33
Electronic copy available at: https://ssrn.com/abstract=4537982

calculated as
422e? − Π
b ? = 76 + 27x − 96α − 32α (3 + α) + 12x (1 + α)(1 + 9α)Π432
4x3 (8 + 27α) + 24x(4 + 4α2 − α)−.
432e? − Π
b ? by J(x, α). We will show Π
e? > Π
b ? by proving J(x, α) > 0
Denote the numerator of Π
for all (x, α) such that α < α1 (x) = (1 − 2x)/2 and x < 1/2. First, note that J(x, α1 (x)) =(1 − x)2 x(4 + 9x)/16 > 0 for all x < 1/2. Then, to prove J(x, α) > 0 for all (x, α), it is sufficient
to show ∂J(x, α)/∂α < 0 for all (x, α). For this, it is sufficient to show ∂J(x, 0)/∂α < 0and ∂ 2 J(x, α)/∂α2 < 0. Notice that ∂J(x, 0)/∂α = −(8 − x(2 + x(10 − 9x)))/36 < 0 for allx ∈ (0, 1/2). Thus, it suffices to show ∂ 2 J(x, α)/∂α2 < 0. To prove this, it is sufficient to show
∂ 2 J(x, 0)/∂α2 < 0 and ∂ 3 J(x, α)/∂α3 < 0. But ∂ 2 J(x, 0)/∂α2 = −(8 + x(8 − 9x))/18 < 0and ∂ 3 J(x, α)/∂α3 = −4/9 < 0. Thus, we have shown J(x, α) > 0 for all (x, α) such thate? > Πb ?.
α < α1 (x) = (1 − 2x)/2 and x < 1/2, hence Π
Next, when α1 (x) ≤ α < α2 (x), the difference in equilibrium profits is given by432e? − Π
b ? = 27x + 4x (8 − 27α) + 4x (3 + 3α(26 + 9α) − 4β)Π432
28x(12α + α(3 − 4β) − 2(6 − β(2 − β)))+4324(67 + 8α3 − 4β(7 − β) − 4α2 (6 + β) − 4α(6 − β(2 − β)))+.
432e ? −Π
b ? is quite demanding. Instead, we numerically calculate
Analytically evaluating the sign of Π
its value for all (x, α) such that α1 (x) ≤ α < α2 (x), which is plotted in Figure 7, where thestraight line in the lower border of the shaded area corresponds to α = α1 (x) and the curved
line in the upper border is α = α2 (x). The region labeled ∆Π > 0 is where the equilibrium
profit is larger after the GDPR and the area labeled ∆Π < 0 is where the equilibrium profit issmaller after the GDPR. The line that divides the two areas is where ∆Π = 0, which defines
α5 (x).

Figure 7: Comparison of equilibrium profits when α1 (x) ≤ α < α2 (x)34Electronic copy available at: https://ssrn.com/abstract=4537982

Finally, when α2 (x) ≤ α, the difference in equilibrium profits is given by3322e? − Π
b ? = 10Γ + 10x + α + β − x (30 + 6α + β − 4Γ)Π27
α(27 − 4Γ − β(2 − β)) + α2 (12 + β − Γ) + α(12 + β − Γ)−27
x(8Γ + α(4Γ + 2β − 39) − β(2 − β) − 36 − 12α2 ) + 16 + 7β−.
27

Figure 8: Comparison of equilibrium profits when α > α2 (x)e? −Πb ? for all (x, α) such that α2 (x) ≤ α, which is plottedOnce again, we numerically calculate Πin Figure 8, where the curved line in the lower border corresponds to α = α2 (x). The region
labeled ∆Π > 0 is where the equilibrium profit is larger after the GDPR and the area labeled∆Π < 0 is where the equilibrium profit is smaller after the GDPR. The curved line that divides
the two areas is where ∆Π = 0, which defines α6 (x).
Proof of Proposition 4.

The proof is by numerical calculations. For the case α < α1 (x),the difference in equilibrium consumer surpluses is given by?

?

g − CSd =∆CS1 := CS2a1a

196 − 128α(α(α + 3) + 3) − 243x4 + 4(81α + 76)x3
2592
24x(16 + α(5 + 16α)) + 12x2 (5 + α(32 − 27α))
.
−
2592

In Figure 9, the entire shaded area is the set {(x, α)|x ∈ [0, 1], α < α1 (x)}, and the region
g?2a > (<) CS
d?1a . The line that divides
labeled ∆CS > (<) 0 is the set of (x, α) for which CS
these two regions is where ∆CS1 = 0, which defines α7 (x).

35Electronic copy available at: https://ssrn.com/abstract=4537982

Figure 9: Consumer surplus comparison when α < α1 (x)When α1 (x) ≤ α < α2 (x), the difference in equilibrium consumer surpluses is given by?

?

g − CSd =∆CS2 := CS2a1b12x2 (23 + 4α + 27α2 − 4β) + 4x3 (112 + 81α) − 243x4
2592
2
24x(34 − 23α − 2α − β(4 − 4α + 2β)) + 4(355 − 4α3 − 204β + 12β 2 )
−
2592
3
2
4(4β + 12α (1 + β) + 12α(17 − 2β + β 2 ))
.
−
2592

In Figure 10, the straight line in the lower border of the shaded area corresponds to α = α1 (x)and the curved line in the upper border is α = α2 (x). Thus, Figure 10 shows how the set{(x, α)|x ∈ [0, 1], α1 (x) ≤ α < α2 (x)} is divided into two regions. The region labeled ∆CS >g?2a > (<) CS
d?1b . The line that divides the two regions is(<) 0 is the set of (x, α) for which CS
where ∆CS2 = 0, which defines α8 (x).

Figure 10: Consumer surplus comparison when α1 (x) ≤ α < α2 (x)36Electronic copy available at: https://ssrn.com/abstract=4537982

When α ≥ α2 (x), the difference in equilibrium consumer surpluses is given by2g? − CSd? = 81(1 − x) − 54(Γ − β) + (Γ + 7(1 − x) − α)(2 − 2x + α − Γ)∆CS3 := CS
2b
1b
162
3
(1 + β − x − α)
.
−
162

2

Figure 11: Consumer surplus comparison when α > α2 (x)In Figure 11, the curved line in the lower border of the shaded area corresponds to α = α2 (x).
Thus, Figure 11 shows how the set {(x, α)|x ∈ [0, 1], α > α2 (x)} is divided into two regions.
g? > (<) CS
d? . The line that
The region labeled ∆CS > (<) 0 is the set of (x, α) for which CS
2b

1b

divides the two regions is where ∆CS3 = 0, which defines α9 (x).
Proof of Proposition 5.

Consider the case of positive correlation where c = φv withφ ∈ (0, 1) and x < φ. First, before the GDPR, consumer v is indifferent between purchase andno purchase if and only if v + (x − c) − p = 0. Substituting c = φv and solving for v, we obtainbvb = (p − x)/(1 − φ). Then, the demand is D(p)= 1 − vb = (1 + x − φ − p)/(1 − φ). The firmbbmaximizes Π(p)= (p + α)D(p),which gives us the equilibrium price and demand as follows:pb∗ =1 + x − α − φ b∗ 1 + x + α − φ
, D =
.
2
2(1 − φ)After the GDPR, consumer v chooses opt-out purchase if c = φv ≥ x and v ≥ p. Denote ve =x/φ. Then ve < 1 by the assumption x < φ and all consumers on [ev , 1] choose opt-out purchaseif ve ≥ p. Next, we show that if consumers on [ev , 1] choose opt-out purchase, then we must haveve ≥ vb. Suppose to the contrary that ve − vb = (x − φp)/(φ(1 − φ)) < 0, hence p > x/φ = ve. This
contradicts the fact that consumer ve is the marginal consumer who chooses opt-out purchase.
As shown previously, the marginal consumer who chooses opt-in purchase is vb = (p − x)/(1 − φ).
e
Put together, the total demand is D(p)= 1 − vb = (1 + x − φ − p)/(1 − φ), and the total opt-in
e S (p) = ve − vb = (x − φp)/(φ(1 − φ)). The firm maximizes Π(p)eee S (p).
demand is D
= pD(p)+ αDbebe S (p))Comparing the profits before and after the GDPR, we have Π(p)− Π(p)= α(D(p)−Dbeb 0 (p) = D
e 0 (p), which implies that the equilibrium pricesince D(p)= D(p).
It is easy to see D
S
37
Electronic copy available at: https://ssrn.com/abstract=4537982

b∗ = De ∗.
and demand after the GDPR the same as those before the GDPR, i.e., pb∗ = pe∗ and D
Given that the equilibrium price and total demand are the same under both regimes but thee∗ < De∗ = Db ∗ after the GDPR, it follows that the firm’s
firm earns data-based revenue from D
Sb∗ > Π
e ∗ . After the GDPR, consumer surplus
equilibrium profit is smaller after the GDPR: Πdoes not change for all consumers on [0, ve∗ ], but increases for consumers on [ev ∗ , 1] because theychoose opt-out purchase after the GDPR given c = φv > x. Consequently, the consumer surplus
is larger in the equilibrium after the GDPR.
Consider now the case of negative correlation where c = 1 − v. First, before the GDPR,
consumer v is indifferent between purchase and no purchase if and only if v + (x − c) − p = 0.
Substituting c = 1 − v and solving for v, we obtain vb = (1 − x + p)/2. Then, the demand is
b
b
b
D(p)
= 1 − vb = (1 + x + p)/2. The firm maximizes Π(p)= (p + α)D(p).
From this, we canderive the equilibrium price, demand, profit, and consumer surplus as follows:pb∗ =1 + x − α b ∗ 1 + x + α b ∗ (1 + x + α)2 d∗ (1 + x + α)2
, D =
, Π =
, CS =.
2
4
8
16

In the above, the equilibrium price is positive because of the restriction α < 1 + x.
After the GDPR, consumer v chooses opt-out purchase if 1 − v = c ≥ x and v ≥ p. Denoteṽ = 1 − x. Then ve < 1 since x > 0. For all v < ve, we have c = 1 − v > 1 − ve = x. Thus, allconsumers on [p, ve] choose opt-out purchase and all consumers on [ev , 1] choose opt-in purchase.
ee S (p) = 1 − ve = x. The
This gives us the total demand D(p)= 1 − p and the opt-in demand Deee S (p), which leads tofirm maximizes Π(p)= pD(p)+ αD
2e S∗ = x, Πe ∗ = 1 + αx, CSg∗ = 4x − 8x + 9 .
e∗ = 1, D
pe∗ = D248e∗ ≥ Db ∗ if and only if
Comparing the above, we have pe∗ ≥ pb∗ if and only if α ≥ x and D
α ≤ 1 − x. For the comparison of profits, note that22e∗ − Πb ∗ = −α + 2(3x − 1)α + (1 − 2x − x ) := H(α) .
Π88√The equation H(α) = 0 has two solutions denoted by αL (x) := (3x − 1) − 8x2 − 8x + 2 and√αH (x) = (3x − 1) + 8x2 − 8x + 2. One can check that αL (x) increases in x, αL (xL ) = 0 at
xL ≈ 0.414, and αL (x) < 1 + x for all x ∈ (0, 1]. Also, αH (x) increases in x, αH (x) > 0 for allx ∈ (0, 1], and αH (x) ≤ 1 + x if and only if x ≤ xH ≈ 0.707. From the above, we can concludee∗ ≥ Π
b ∗ if and only if α ≤ αH (x). Second, if x ∈ [xL , xH ),the following. First, if x < xL , then Πe∗ ≥ Π
b ∗ if and only if α ∈ [αL (x), αH (x)]. Third, if x ≥ xH , then Πe∗ ≥ Π
b ∗ if and only ifthen Π
α ≥ αL .
For the comparison of consumer surpluses, note that22g∗ − CSd∗ = −α − 2(1 + x)α + 7x − 18x + 17 := G(α) .
CS1616The equation G(α) = 0 has two solutions, one negative and the other positive. The positive√
solution is given by αCS (x) := −(1 + x) + 8x2 − 16x + 18. Once can check that αCS (x) is
decreasing in x, αCS (x) > 0 for all x ∈ (0, 1], and αCS (x) ≥ 1 + x for all x ≤ xCS ≈ 0.65
38Electronic copy available at: https://ssrn.com/abstract=4537982

∗∗g ≥ CSd for allwhere 1 + x is an upper bound on α. From the above, we can conclude that CS
α < 1 + x if x < xCS , and for all α ≤ αCS if x ≥ xCS .

References
Acemoglu, Daron, Ali Makhdoumi, Azarakhsh Malekian, and Asu Ozdaglar (2022) “Too muchdata: Prices and inefficiencies in data markets,” American Economic Journal: Microeconomics, Vol. 14, No. 4, pp. 218–256.
Acquisti, Alessandro, Laura Brandimarte, and George Loewenstein (2015) “Privacy and humanbehavior in the age of information,” Science, Vol. 347, No. 6221, pp. 509–514.
Acquisti, Alessandro, Curtis Taylor, and Liad Wagman (2016) “The economics of privacy,”
Journal of Economic Literature, Vol. 54, No. 2, pp. 442–492.
Anderson, Simon P. and Joshua S. Gans (2011) “Platform siphoning: Ad-avoidance and media
content,” American Economic Journal: Microeconomics, Vol. 3, No. 4, pp. 1–34.
Aridor, Guy, Yeon-Koo Che, and Tobias Salz (forthcoming) “The effect of privacy regulationon the data industry: Empirical evidence from GDPR,” RAND Journal of Economics.
Batikas, Michail, Yi Liu, Hakan Ozlap, and Milan Miric (2023) “Impact of privacy regulation
on experimentation and innovation,” Academey of Management Proceedings, Vol. 2023, No.
1, p. 17060.
Belleflamme, Paul and Wouter Vergote (2016) “Monopoly price discrimination and privacy:
The hidden cost of hiding,” Economics Letters, Vol. 149, pp. 141–144.
Bergemann, Dirk and Alessandro Bonatti (2015) “Selling cookies,” American Economic Journal:
Microeconomics, Vol. 7, No. 3, pp. 259–294.
Bergemann, Dirk, Alessandro Bonatti, and Tan Gan (2022) “The economics of social data,”
RAND Journal of Economics, Vol. 53, No. 2, pp. 263–296.
Bessen, James, Stephen Michael Impimk, Lydia Reichensperger, and Robert Seamans(2020) “GDPR and the importance of data to AI startups,”

Discussion Paper,

http://dx.doi.org/10.2139/ssrn.3576714.
Braghieri, Luca (2019) “Targeted advertising and price discrimination in intermediated online
markets,” Discussion Paper, http://dx.doi.org/10.2139/ssrn.3072692.
Campbell, James, Avi Goldfarb, and Catherine Tucker (2015) “Privacy regulation and market
structure,” Journal of Economics & Management Strategy, Vol. 24, No. 1, pp. 47–73.
Chaudhury, Ratul Das and Chongwoo Choe (2023) “Digital privacy: GDPR and its lessons forAustralia,” Australian Economic Review, Vol. 56, No. 2, pp. 204–220.
Chen, Zhijun (2022) “Privacy costs and consumer data acquisition: An economic analysis ofdata privacy regulation,” Discussion Paper, http://dx.doi.org/10.2139/ssrn.4085923.
39
Electronic copy available at: https://ssrn.com/abstract=4537982

Chen, Zhijun, Chongwoo Choe, and Noriaki Matsushima (2020) “Competitive personalized
pricing,” Management Science, Vol. 66, No. 9, pp. 4003–4023.
Choe, Chongwoo, Stephen King, and Noriaki Matsushima (2018) “Pricing with cookies: behaviorbased price discrimination and spatial competition,” Management Science, Vol. 64, No.
12, pp. 5669–5687.
Choi, Jay Pil, Doh-Shin Jeon, and Byung-Cheol Kim (2019) “Privacy and personal data collection with information externalities,” Journal of Public Economics, Vol. 173, pp. 113–124.
Cong, Jiajia and Noriaki Matsushima (2023) “The effects of personal data management oncompetition and welfare,” ISER Discussion Paper 1201.
Congiu, Raffaele, Lorien Sabatino, and Geza Sapi (2022) “The impact of privacy regulation
on web traffic: Evidence from the GDPR,” Information Economics and Policy, Vol. 61, p.
101003.
Fainmesser, Itay P., Andrea Galeotti, and Ruslan Momot (2023) “Digital privacy,” Management
Science, Vol. 69, No. 6, pp. 3157–3173.
Ghose, Anindya (2017) Tap: Unlocking the mobile economy: The MIT Press.
Godinho de Matos, Miguel and Idris Adjerid (2022) “Consumer consent and firm targeting
after GDPR: The case of a large telecom provider,” Management Science, Vol. 68, No. 5, pp.
3330–3378.
Goldberg,

Samuel G.,

lating privacy online:

Garrett A. Johnson,

and Scott K. Shriver (2022) “Regu-

An economic evaluation of the GDPR,” Discussion Paper,

http://dx.doi.org/10.2139/ssrn.3421731.
Goldfarb, Avi and Catherine Tucker (2012) “Shifts in privacy conerns,” American Economic
Review, Vol. 102, No. 3, pp. 349–353.
Gopal, Ram. D., Hooman Hidaji, Sule Nur Kutlu, Raymond A. Patterson, and Niam Yaraghi(forthcoming) “Law, economics, and privacy: Implications of government policies on website
and third-party information sharing,” Information Systems Research.
Hagiu, Andrei and Julian Wright (forthcoming) “Data-enabled learning, network effects andcompetitive advantage,” RAND Journal of Economics.
Ichihashi, Shota (2021) “The economics of data externalities,” Journal of Economic Theory,
Vol. 196, p. 105316.
(2023) “Dynamic privacy choices,” American Economic Journal: Microeconomics, Vol.
15, No. 2, pp. 1–40.
Janßen, Rebecca, Reinhold Kesler, Michael E. Kummer, and Joel Waldfogel (2022) “GDPR
and the lost generation of innovation apps,” NBER Working Paper 30028.

40
Electronic copy available at: https://ssrn.com/abstract=4537982

Jentzsch, Nicola, Geza Sapi, and Irina Suleymanova (2013) “Targeted pricing and customer
data sharing among rivals,” International Journal of Industrial Organization, Vol. 31, pp.
131–144.
Jia, Jian, Ginger Zhe Jin, and Liad Wagman (2021) “The short-run effects of the General Data
Protection Regulation on technology venture investment,” Marketing Science, Vol. 40, No. 4,
pp. 661–684.
Johnson, Eric J., Steven Bellman, and Gerald L. Lohse (2002) “Defaults, framing and privacy:
Why opting in-opting out,” Marketing Letters, Vol. 13, No. 1, pp. 5–15.
Johnson, Garrett A., Scott K. Shriver, and Shaoyin Du (2020) “Consumer privacy choice inonline advertising: Who opts out and at what cost to industry?” Marketing Science, Vol. 39,
No. 1, pp. 33–51.
Johnson, Garrett A., Scott K. Shriver, and Samuel G. Goldberg (forthcoming) “Privacy andmarket concentration: Intended and unintended consequences of the GDPR,” Management
Science.
Ke, T. Tony and K. Sudhir (2023) “Privacy rights and data security: GDPR and personal data
markets,” Management Science, Vol. 69, No. 8, pp. 4389–4412.
Lin, Tesary (2022) “Valuing intrinsic and instrumental preferences for privacy,” Marketing Science, Vol. 41, No. 4, pp. 235–253.
Macha, Meghanath, Natasha Zhang Foutz, Beibei Li, and Anindya Ghose (forthcoming) “Personalized privacy preservation in consumer mobile trajectories,” Information Systems Research.
Machuletz, Dominique and Rainer Böhme (2020) “Multiple Purposes, Multiple Problems: A
User Study of Consent Dialogs after GDPR,” Proceedings on Privacy Enhancing Technologies
2020, Vol. 2020, No. 2, pp. 481–498.
Matte, Célestin, Nataliia Bievola, and Cristina Santos (2020) “Do Cookie Banners Respect
my Choice?: Measuring Legal Compliance of Banners from IAB Europe’s Transparency andConsent Framework,” 2020 IEEE Symposium on Security and Privacy, pp. 791–809.
Miklós-Thal, Jeanine, Avi Goldfarb, Avery M. Haviv, and Catherine Tucker (2023) “Digital
hermits,” NBER Working Paper 30920.
Nouwens, Midas, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal (2020) “Dark
Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence,”
Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, pp. 1–13.
Obar, Jonathan A. and Anne Oeldorf-Hirsch (2020) “The biggest lie on the Internet: Ignoring
the privacy policies and terms of service policies of social networking services,” Information,
Communication & Society, Vol. 23, No. 1, pp. 128–147.

41
Electronic copy available at: https://ssrn.com/abstract=4537982

Peukert, Christian, Stefan Bechtold, Michail Batikas, and Tobias Kretschmer (2022) “Regulatory spillovers and data governance: Evidence from the GDPR,” Marketing Science, Vol. 41,
No. 4, pp. 318–340.
Pew Research Center (2019) “Americans and privacy: Cencerned, confused and feeling lack ofcontrol over their personal information.”
Schmitt,

Julia,

Klaus M. Miller,

and Bernd Skiera (2021) “The impact of pri-vacy laws on online user behavior,” HEC Paris Research Paper No MKG-2021-1437,
http://dx.doi.org/10.2139/ssrn.3774110.
Utz, Christine, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz (2019)“(Un)informed Consent: Studying GDPR Consent Notices in the Field,” Proceedings of the2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 973–990.

42
Electronic copy available at: https://ssrn.com/abstract=4537982