The Impact of the General Data Protection Regulation (GDPR) on Online Usage Behavior

TL;DR

This study empirically assesses the GDPR's impact on online usage, revealing significant decreases in visits and revenue, with effects varying by industry and website size, and indicating increased market concentration.

Contribution

It provides the first comprehensive empirical analysis of GDPR's effects on online behavior across multiple industries using a generalized synthetic control approach.

Findings

Weekly visits decreased by 4.88% in 3 months and 10.02% after 18 months.

Average revenue losses of USD 7 million for e-commerce and USD 2.5 million for ad-based websites.

GDPR effects vary by website size, industry, and user origin, with larger websites less affected.

Abstract

Privacy regulations often necessitate a balance between safeguarding consumer privacy and preventing economic losses for firms that utilize consumer data. However, little empirical evidence exists on how such laws affect firm performance. This study aims to fill that gap by quantifying the impact of the European Union's General Data Protection Regulation (GDPR) on online usage behavior over time. We analyzed data from 6,286 websites across 24 industries, covering 10 months before and 18 months after the GDPR's enactment in 2018. Employing a generalized synthetic control estimator, we isolated the short- and long-term effects of the GDPR on user behavior. Our results show that the GDPR negatively affected online usage per website on average; specifically, weekly visits decreased by 4.88% in the first 3 months and 10.02% after 18 months post-enactment. At the 18-month mark, these declines translated into average revenue losses of about USD 7 million for e-commerce websites and nearly USD 2.5 million for ad-based websites. Nonetheless, the GDPR's impact varied across website size, industry, and user origin, with some large websites and industries benefiting from the regulation. Notably, the largest 10% of websites pre-GDPR suffered less, suggesting that the GDPR has increased market concentration.