Abstract:General Data Protection Regulation (GDPR)—the European Union’s data protection regulation—has two key principles. It recognizes that individuals own and control their personal (but not contractual) data in perpetuity, leading to three critical privacy rights, namely, the rights to (i) explicit consent (data opt-in), (ii) to be forgotten (data erasure), and (iii) portability (data transfer). It also includes data security mandates against privacy breaches through unauthorized access. We study GDPR’s equilibrium impact by including these features in a dynamic two-period model of forward-looking firms and consumers. Firms collect consumer data for personalization and price discrimination. Consumers trade off gains from personalization relative to potential losses from privacy breaches and price discrimination in their purchase, data opt-in, erasure, and transfer decisions. Though data security mandates impose fines on firms for privacy breaches, firms can benefit from higher opt-in given lower breach risk. Surprisingly, data security mandates can hurt consumers. The effect of privacy rights is nuanced. Since the right to opt in separates goods exchange from the provision of personal data, it prevents market failure under high breach risk. But it also reduces consumer opt-in and personal data availability. Erasure and portability rights reduce consumers’ hold-up concerns by disciplining firms to provide ongoing value by limiting price discrimination and not slacking off on data security; but they also reduce the incentive to offer lower initial prices that encourages opt-in. Overall, privacy rights always benefit consumers in competitive markets, but they can surprisingly hurt consumers under monopoly, as monopolists have less incentives to subsidize consumer opt-in. They raise (reduce) firm profit and social welfare when breach risk is high (low). Finally, privacy rights increase firm profit most at moderate levels of data transferability. This paper was accepted by Dmitri Kuksov, marketing. Funding: T. T. Ke acknowledges financial support from the General Research Fund of the Hong Kong Research Grants Council [Grant 14500421]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/mnsc.2022.4614 .

Preference-Based Privacy Markets (vol 8, Pg 146006, 2020)

Corrections to “Preference-Based Privacy Markets”

A Privacy Framework

A Privacy Framework: Indistinguishable Privacy

A Privacy-Aware Framework for Online Advertisement Targeting

Preference-Based Privacy Trading

Privacy Requirements Patterns for Mobile Operating Systems

Privacy Risk is a Function of Information Type: Learnings for the Surveillance Capitalism Age.

Equity and Privacy: More Than Just a Tradeoff

{A New Hope}: Contextual Privacy Policies for Mobile Applications and An Approach Toward Automated Generation

Optimized, Direct Sale of Privacy in Personal-Data Marketplaces

Does the Presence of Privacy Relevant Information Affect App Market Choice?

SeePrivacy: Automated Contextual Privacy Policy Generation for Mobile Applications

The Empirical Implications of Privacy-Aware Choice

SOK: Privacy Definitions and Classical Mechanisms in the Local Setting

Privacy Rights and Data Security: GDPR and Personal Data Markets

Privacy in LLM-based Recommendation: Recent Advances and Future Directions

Revealing the landscape of privacy-enhancing technologies in the context of data markets for the IoT: A systematic literature review

The Privacy Paradox and Optimal Bias–Variance Trade-offs in Data Acquisition

Covering the Sensitive Subjects to Protect Personal Privacy in Personalized Recommendation.

Privacy-Aware Data Acquisition under Data Similarity in Regression Markets