Privacy Regulation and Market Structure

• DOI: http://doi.org/10.1111/jems.12079
• Published date: 01 March 2015
• Date: 01 March 2015

Privacy Regulation and Market Structure

JAMES CAMPBELL

University of Toronto

Toronto,ON, Canada

James.Campbell@rotman.utoronto.ca

AVI GOLDFARB

University of Toronto

Toronto,ON, Canada

and National Bureau of Economic Research

agoldfarb@rotman.utoronto.ca

CATHERINE TUCKER

MIT Sloan School of Management

MIT, Cambridge, MA

and National Bureau of Economic Research

cetucker@mit.edu

This paper models how regulatory attempts to protect the privacy of consumers’ data affect the

competitive structure of data-intensive industries. Our results suggest that the commonly used

consent-based approach may disproportionately benefit firms that offer a larger scope of services.

Therefore, though privacy regulation imposes costs on all firms, it is small firms and new firms

that are most adversely affected. We then show that this negative effect will be particularly severe

for goods where the price mechanism does not mediate the effect, such as the advertising-supported

Internet.

1. Introduction

Firms now automate, parse, and collect customer data at an unprecedented rate. Many

firms, from search engines like Google to credit card companies like Capital One, have

realized considerable profits on the basis of the ability to analyze massive amounts of

customer data in order to improve their offerings. This leads to two concerns from a

regulatory perspective. First, data-intensive operations can lead to natural economies

of scale and, on many occasions, network effects. This may generate market power and

monopoly (Heyer et al., 2009). Second, data-intensive operations can lead to concerns

about privacy.In this paper, we build a theoretical model to ask how attempts to protect

consumer privacy can affect the competitive structure of such industries.

In a world with no transaction costs, one might expect privacy regulation to fa-

vor small firms over large ones: if data generate economies of scale, then reduced

access to data might help to overcome such effects. However, this ignores that most

privacy regulation requires firms to obtain one-time individual consumer consent to

use consumer data (rather than the consent requests increasing with the amount of data

used). Therefore, privacy regulation imposes transaction costs whose effects, our model

We thank Alex White, Michael Grubb, and Torben St¨

uhmeier and seminar participants at the 2011 IIOC and

the University of Torontofor useful comments. All errors are our own.

C2015 Wiley Periodicals, Inc.

Journal of Economics & Management Strategy, Volume24, Number 1, Spring 2015, 47–73

48 Journal of Economics & Management Strategy

suggests, will fall disproportionately on smaller firms. Consequently, rather than increas-

ing competition, the nature of transaction costs implied by privacy regulation suggests

that privacy regulation may be anticompetitive.

Specifically, we build a model of competition between a generalist firm offering

products that appeal to a variety of consumer needs and a specialist firm offering a

product that serves fewer consumer needs. The specialist firm offers higher quality con-

tent, but only for their particular niche. A firm’s profits depend on how many customers

they attract. Customer data help both generalist and specialist firms to optimize product

offerings. The revenue per customer is higher when firms can leverage customer data.

We focus our discussion on the advertising-supported Internet, where larger generalist

and smaller specialist firms leverage customer data to increase the profits per customer.

In our conclusion, we discuss the application of the ideas to other industry contexts.

In our model, without privacy regulation, consumers suffer harm when consuming

any product since rules on data exploitation are ill-defined. Both the generalist and the

specialist use freely available data to optimize their product offerings, and under general

circumstances, a consumer uses both services if she is not too concerned about privacy

and uses no product if she is sufficiently concerned.

We model privacy regulation as meaning that consumers now incur a cost when

prompted to give consent to use their data. This reflects the frictions imposed by current

consent requirements in the EU’s Data Protection Directive (95/46/EC) and Privacy and

Electronic Communications Directive (2002/58/EC) and its amendment (2009/135/EC)

as well as the language in proposed U.S. privacy regulation (Corbin, 2010; FTC, 2010).

Weshow that such privacy regulation can preclude profitable entry by the specialist

firm. Under regulation, the extra costs required to obtain consent mean that in some

cases where entry had been profitable without regulation, the specialist firm will choose

not to enter. The generalist firm then captures the whole market. This implies that

privacy regulation can increase the advantage enjoyed by a large generalist firm. This

deprives consumers of the higher quality niche product offered by a specialist firm,

which represents a loss that must be balanced against any gain to consumers due to

the increased privacy. This basic model also implies that if the generalist is sufficiently

strong relative to the specialist, consumers are willing to tolerate greater exploitation of

data by the generalist than the specialist.

We extend this basic model in three ways. First, we show that the impact of regu-

lation is strongest in industries with little price flexibility. This would be more likely

to be the case for digital goods such as the advertising-supported Internet where

consumers traditionally do not pay a price for the service. Second, we show that

the model’s conclusions are robust to there being several potential specialist firms each

serving a different niche. Third, we allow for investment in quality and show that the

entrant never invests more in quality under regulation than without regulation, and in

some cases invests less.

Overall, our model suggests that privacy regulation can alter the competitive mar-

ket structure of data-intensive industries. The relationship in the model between pricing,

quality,and privacy builds on Acquisti and Varian (2005) and Fudenberg and Villas-Boas

(2006), who emphasize behavioral-based price discrimination. The idea that regulation

designed to protect consumers can entrench incumbents has a long history in industrial

organization. For example, Farr et al. (2001) and Clark (2007) argue that advertising

restrictions (for cigarettes and children’s breakfast cereals, respectively) benefited the

existing producers. Similarly, Armstrong and Sappington (2007) show that an aver-

age price cap regime can act as a powerful source of entry deterrence and Armstrong