Abstract:General Data Protection Regulation (GDPR)—the European Union’s data protection regulation—has two key principles. It recognizes that individuals own and control their personal (but not contractual) data in perpetuity, leading to three critical privacy rights, namely, the rights to (i) explicit consent (data opt-in), (ii) to be forgotten (data erasure), and (iii) portability (data transfer). It also includes data security mandates against privacy breaches through unauthorized access. We study GDPR’s equilibrium impact by including these features in a dynamic two-period model of forward-looking firms and consumers. Firms collect consumer data for personalization and price discrimination. Consumers trade off gains from personalization relative to potential losses from privacy breaches and price discrimination in their purchase, data opt-in, erasure, and transfer decisions. Though data security mandates impose fines on firms for privacy breaches, firms can benefit from higher opt-in given lower breach risk. Surprisingly, data security mandates can hurt consumers. The effect of privacy rights is nuanced. Since the right to opt in separates goods exchange from the provision of personal data, it prevents market failure under high breach risk. But it also reduces consumer opt-in and personal data availability. Erasure and portability rights reduce consumers’ hold-up concerns by disciplining firms to provide ongoing value by limiting price discrimination and not slacking off on data security; but they also reduce the incentive to offer lower initial prices that encourages opt-in. Overall, privacy rights always benefit consumers in competitive markets, but they can surprisingly hurt consumers under monopoly, as monopolists have less incentives to subsidize consumer opt-in. They raise (reduce) firm profit and social welfare when breach risk is high (low). Finally, privacy rights increase firm profit most at moderate levels of data transferability. This paper was accepted by Dmitri Kuksov, marketing. Funding: T. T. Ke acknowledges financial support from the General Research Fund of the Hong Kong Research Grants Council [Grant 14500421]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/mnsc.2022.4614 .

Trust and commitment: Effect of applying consumer data rights on U.S. Consumers' attitudes toward online retailers in big data era

The effects of voluntary GDPR adoption and the readability of privacy statements on customers’ information disclosure intention and trust

Privacy Rights and Data Security: GDPR and Personal Data Markets

Exploring the Impact of GDPR on Big Data Analytics Operations in the E-Commerce Industry

Did the GDPR increase trust in data collectors? Evidence from observational and experimental data

Human-GDPR Interaction: Practical Experiences of Accessing Personal Data

The European Union’s GDPR and Its Effect on Data-Driven Marketing Strategies

Impact of the General Data Protection Regulation on the Global Mobile App Market: Digital Trade Implications of Data Protection and Privacy Regulations

The Impact of the General Data Protection Regulation (GDPR) on Online Usage Behavior

The Impact of Privacy Laws on Online User Behavior

Regulating Privacy Online: An Economic Evaluation of the GDPR

Data Privacy Regulation and Cross-Border E-Commerce

Privacy Regulations and Online Search Friction: Evidence from GDPR

Online Trust: an International Study of Subjects' Willingness to Shop at Online Merchants, Including the Effects of Promises and of Third Party Guarantees.

The European Union general data protection regulation: what it is and what it means

A Law and Economics Approach to the New EU Privacy Regulation: Analysing the European General Data Protection Regulation

Consumer Privacy Regulations

Privacy regulation and firm performance: Estimating the GDPR effect globally

The Unwanted Sharing Economy: An Analysis of Cookie Syncing and User Transparency under GDPR

Evaluating the Effects of Digital Privacy Regulations on User Trust

Global Differences in Online Shopping Behavior: Understanding Factors Leading to Trust.