  Policy makers worldwide draft privacy laws that require trading-off between
safeguarding consumer privacy and preventing economic damage to companies that
use consumer data. However, little empirical knowledge exists as to how privacy
laws affect companies' performance. Accordingly, this paper empirically
quantifies the effects of the enforcement of the EU's General Data Protection
Regulation (GDPR) on online user behavior over time, analyzing data from 6,286
websites spanning 24 industries, during the 10 months before and 18 months
after the GDPR's enforcement in 2018. A difference-in-differences analysis,
with a synthetic control group approach, enables the short- and long-term
effects of the GDPR on user behavior to be reliably isolated. The results show
that, on average, the GDPR's effects on user quantity and usage intensity were
negative; e.g., 3 months (18 months) post-GDPR, the numbers of unique visitors
and total visits to a website decreased by 0.8% (6.6%) and 4.9% (10%),
respectively. These effects could translate into average revenue losses of 7
million USD for e-commerce websites and almost 2.5 million USD for ad-based
websites 18 months after GDPR. The GDPR's effects vary across websites, with
some industries even benefiting from it; moreover, more-popular websites
suffered less damage, suggesting that the GDPR increased market concentration.
