Law, economics, and privacy : implications of government policies on website and third-party information sharing

Widespread abuse of internet users’ privacy online has prompted user advocacy groups to implore governments to intervene and protect consumer rights. To study such interventions’ effects, we examine data-protection policies that policy makers and governments can enforce on websites, including consent-based user information sharing and subsidizing competing websites. We use a stylized analytical model to examine such policies’ impact on the decisions and outcomes of websites, users, and third-parties. Interestingly, we find that even though a consent-based policy may improve user surplus, in the absence of market entry and exit (static market), it has the unintended consequence of increasing the number of third-parties and, thus, sharing of user information. We also determine that both consent-based and website subsidization policies may reduce competition by driving websites out of the market—to the detriment of user surplus and social welfare. To validate our analytical model’s findings, we empirically investigated the impact of a consent-based policy on third-parties in a natural experiment of the California Consumer Privacy Act. These findings raise significant implications for policy making surrounding online privacy.History: Giri Kumar Tayi, Senior Editor; Nachiketa Sahoo, Associate Editor.Funding: Financial support from the Social Sciences and Humanities Research Council of Canada is gratefully acknowledged. R. D. Gopal gratefully acknowledges support by the Gillmore Centre for Financial Technology at the Warwick Business School.Supplemental Material: The online appendix is available at https://doi.org/10.1287/isre.2022.1178.