The Impact of the General Data Protection Regulation (GDPR) on Online Usage Behavior (2411.11589v1)

Abstract: Privacy regulations often necessitate a balance between safeguarding consumer privacy and preventing economic losses for firms that utilize consumer data. However, little empirical evidence exists on how such laws affect firm performance. This study aims to fill that gap by quantifying the impact of the European Union's General Data Protection Regulation (GDPR) on online usage behavior over time. We analyzed data from 6,286 websites across 24 industries, covering 10 months before and 18 months after the GDPR's enactment in 2018. Employing a generalized synthetic control estimator, we isolated the short- and long-term effects of the GDPR on user behavior. Our results show that the GDPR negatively affected online usage per website on average; specifically, weekly visits decreased by 4.88% in the first 3 months and 10.02% after 18 months post-enactment. At the 18-month mark, these declines translated into average revenue losses of about USD 7 million for e-commerce websites and nearly USD 2.5 million for ad-based websites. Nonetheless, the GDPR's impact varied across website size, industry, and user origin, with some large websites and industries benefiting from the regulation. Notably, the largest 10% of websites pre-GDPR suffered less, suggesting that the GDPR has increased market concentration.