Revealing transactions data to third parties: Implications of privacy regimes for welfare in online markets

• Author: David E. M. Sappington,Michael R. Baye
• DOI: http://doi.org/10.1111/jems.12337
• Date: 01 April 2020
• Published date: 01 April 2020

J Econ Manage Strat. 2020;29:260–275.wileyonlinelibrary.com/journal/jems260

|

© 2019 Wiley Periodicals, Inc.

Received: 9 May 2019

|

Revised: 24 October 2019

|

Accepted: 16 November 2019

DOI: 10.1111/jems.12337

ORIGINAL ARTICLE

Revealing transactions data to third parties: Implications

of privacy regimes for welfare in online markets

Michael R. Baye

1

|

David E. M. Sappington

2

1

Department of Business Economics and

Public Policy, Kelley School of Business,

Indiana University, Bloomington, Indiana

2

Department of Economics, University of

Florida, Gainesville, Florida

Correspondence

David E. M. Sappington, Department of

Economics, University of Florida,

Gainesville, FL 117140.

Email: sapping@ufl.edu

Abstract

We examine the effects of privacy policies regarding transactions (e.g., price/

quantity) data on online shopping platforms. Disclosure of transactions data

induces consumer signaling behavior that affects merchant pricing decisions

and the welfare of platform participants. A profit‐maximizing platform prefers

the disclosure policy that maximizes total welfare. Although this policy benefits

sophisticated consumers, it harms unsophisticated (myopic) consumers.

Consequently, the welfare effects of alternative privacy policies, data breaches,

deceptive privacy policies, and opt‐in/opt‐out requirements can differ sharply,

depending on the level of consumer sophistication and on other factors such as

the prevailing status quo.

1

|

INTRODUCTION

Consumer protection agencies in the United States and the European Union continue to scrutinize the use of “big data”

by online platforms such as Amazon, Apple, Facebook, and Google. In the United States, dozens of regulators are

investigating the type of data that platforms collect, how the data are employed, and whether consumers are well served

when a platform’s ability to use transactions data or share them with third parties is restricted.

1

The goal of this paper is

to provide a better understanding of the transactions data privacy policies that consumers and platforms prefer and the

welfare effects of related regulatory restrictions.

The economic literature has established that restricting the use or limiting the sharing of transactions data can either

benefit or harm consumers.

2

Restricting a platform’s ability to track the purchases of individual consumers can harm

consumers by limiting the platform’s ability to efficiently match consumers with products and/or advertisers (Evans,

2009).

3

However, the same privacy policy can benefit consumers by preventing a monopolist from exploiting in one

transaction information it learns about a customer in a different transaction (Acquisti & Varian, 2005). The literature

also notes that the welfare effects of privacy policies depend on whether consumers are sophisticated, that is, whether

they fully anticipate how their present purchase decisions may affect the prices they face in subsequent transactions

(Taylor, 2004).

4

We extend this literature in four primary ways. First, we identify conditions under which a platform’s preferred

privacy policy maximizes total welfare. Second, we examine how mandated alternatives to the platform’s preferred

policy affect the welfare of sophisticated and unsophisticated consumers. Third, we assess the welfare effects of “opt‐in”

mandates (that require consumers to give their explicit consent before platforms can share transactions data with third

parties) and “opt‐out”mandates (that require platforms to allow consumers to request and thereby receive a personal

exemption from default sharing of transactions data). Fourth, we analyze the welfare effects of data breaches (caused by

hackers, e.g.), deceptive privacy policies, and requirements to remove personally identifiable information before data is

shared with third parties.

In our model, consumers purchase two distinct (noncompeting) products from different merchants on an online

platform. When transactions data are shared on the platform, a consumer’s interaction with one merchant may reveal

to other merchants the consumer’s reservation value for their products. The other merchants may modify the prices

they charge the consumer accordingly. A sophisticated consumer who recognizes this effect of data sharing takes it into

account when interacting with all merchants. In contrast, when he decides whether to purchase a merchant’s product,

an unsophisticated consumer only considers whether the price the merchant sets exceeds his reservation value for the

product.

We find that sophisticated consumers and the platform generally benefit when the platform shares all transactions

data with third parties (i.e., other merchants on the platform). The data sharing provides a channel through which

sophisticated consumers can credibly signal when their reservation values for the merchants’products are low. Such

signaling induces price concessions from merchants.

5

When the platform does not share transactions data, it effectively

closes the signaling channel, thereby harming sophisticated consumers. Closing the channel also reduces platform

profit and total welfare by limiting the consummation of welfare‐enhancing transactions.

In contrast, unsophisticated consumers benefit when the platform never shares transactions data with third parties.

This privacy policy prevents merchants from exploiting unsophisticated consumers by charging them higher prices after

they are observed to pay high prices to other merchants. Thus, the privacy policy that best serves unsophisticated

consumers harms sophisticated consumers. Consequently, the formulation of privacy regulations for online platforms

can be challenging even when the sole objective of the regulations is to maximize consumer welfare.

The varying impacts of a platform’s privacy policy on the welfare of sophisticated and unsophisticated consumers

might lead one to conclude that consumer welfare would unambiguously rise under regulations giving each consumer

property rights over his data, such that the platform can only share the data with third parties if the consumer opts‐in.

We show that these (and related opt‐out) policies that allow each consumer to select his or her optimal privacy policy

are not a panacea. The impact of opt‐in and opt‐out mandates also varies with the degree of consumer sophistication

and with the magnitude of the costs that consumers must incur to opt‐in to or opt‐out of the platform’s prevailing

privacy policy.

6

In our model, requiring explicit consumer consent before transactions data are shared with third parties

can harm sophisticated consumers.

We also examine how violations of a platform’s stated privacy policy (through data breaches by hackers or deception

by the platform) affect the welfare of the platform’s customers.

7

We find, for example, that when the platform

announces it will implement the privacy policy that maximizes the welfare of unsophisticated consumers, both

sophisticated and unsophisticated consumers are harmed by an unanticipated violation of the platform’s announced

privacy policy. However, some consumers are not harmed and harm only arises under certain configurations of

merchant costs.

8

In contrast, when the platform adopts the policy that maximizes the welfare of sophisticated

consumers, a data breach does not harm consumers (because their transactions data are already known to all

merchants on the platform). However, a violation of this privacy policy can harm sophisticated consumers by

foreclosing the signaling channel through which they can secure price concessions. Therefore, the effects of data

breaches and violations of privacy policies can differ for sophisticated and unsophisticated consumers. In addition, the

effects of data breaches can differ from the effects of deceptive practices or violations of the platform’s stated privacy

policies.

We find that total welfare, platform profit, and the welfare of sophisticated consumers are maximized when the

platform provides transactions data to third parties. Consequently, under a laissez faire policy that permits the platform

to implement its preferred privacy policy, the platform will adopt the privacy policy that maximizes the welfare of

sophisticated consumers. This privacy policy is not ideal for unsophisticated consumers, however. It is also not the best

policy for all merchants.

We also examine the impact of removing all information about a consumer’s identity before transactions data are

shared with third parties. The removal of such personal information can benefit unsophisticated consumers, but does

not always do so. The removal generally harms sophisticated consumers by effectively closing the channel through

which they might signal their low reservations values for the merchants’products.

Our analysis differs from the seminal work of Taylor (2004) and Acquisti and Varian (2005) by analyzing platform

incentives, opt‐in and opt‐out mandates, and requirements to remove all information about a consumer’s identity

before transactions data are shared with third parties.

9

Taylor (2004) focuses on the impact of limits on the ability of

individual merchants (rather than the platform) to sell customer transactions data to other merchants.

10

We find that

the incentive of the platform to disclose transactions data to its merchants can differ significantly from the incentive of

an individual merchant to disclose its transactions data to other merchants. In our model, a merchant whose data are

BAYE AND SAPPINGTON

|

261