Privacy & Market Concentration: Intended & Unintended Consequences of the GDPR
56 Pages Posted: 15 Nov 2019 Last revised: 1 Feb 2022
Date Written: January 31, 2022
We show that websites' vendor use falls after the European Union's General Data Protection Regulation (GDPR), but that market concentration also increases among technology vendors that provide support services to websites. We collect panel data on the web technology vendors selected by more than 27,000 top websites internationally. The week after the GDPR's enforcement, website use of web technology vendors falls by 15% for EU residents. Websites are more likely to drop smaller vendors, which increases the relative concentration of the vendor market by 17%. Increased concentration predominantly arises among vendors that use personal data such as cookies, and from the increased relative shares of Facebook and Google-owned vendors, but not from website consent requests. Though the aggregate changes in vendor use and vendor concentration dissipate by the end of 2018, we find that the GDPR impact persists in the advertising vendor category most scrutinized by regulators. Our findings shed light on potential explanations for the sudden drop and subsequent rebound in vendor usage.
Keywords: Privacy, GDPR, Competition, Web Technology, Regulatory compliance
JEL Classification: D04, K21, L11, L22, L51, L86, M30, M38, O38
Suggested Citation: Suggested Citation