Offense on Defense: Competitive Data Protection Investment with Behavior-Based Pricing

Abstract

This paper explores a firm’s incentive to invest in data protection to mitigate the risk of compromising consumer privacy, in the context of duopoly competition with behavior-based pricing. A consumer’s personal information (privacy), once collected and stored by a firm, remains within the firm’s control, making it susceptible to potential data breaches even after the consumer has stopped purchasing from it. Consequently, a firm’s privacy protection influences the purchasing decisions of prospective consumers rather than existing ones. This makes privacy protection a unique product quality that is conditionally sunk, distinguishing it from standard product quality or switching costs. We find that privacy protection may not shield firms’ existing consumers from poaching but may help them acquire new consumers (i.e., switchers). We discovered an inverted U-shaped relationship between a firm’s privacy protection and consumer disutility from privacy loss if the leak risk is high. Our welfare analysis shows that mitigating consumer disutility from privacy loss could harm consumers if the leak risk is not high. An important policy implication is that privacy measures aimed at consumer protection may either be strengthened or weakened by firms’ strategic decisions regarding privacy protection. Thus, finding the optimal spot for such measures is crucial.

Keywords: Privacy, consumer protection, competitive strategy, product design

JEL Classification: D18, L13, L15