Privacy & Market Concentration : Intended & Unintended Consequences of the GDPR

We show that the European Union's General Data Protection Regulation (GDPR) reduced data sharing online, but had the unintended consequence of increasing market concentration among technology vendors that provide support services to websites. We collect panel data on the web technology vendors selected by more than 27,000 top websites internationally. The week after the GDPR's enforcement, website use of web technology vendors for EU users falls by 15%. Websites that would face greater penalties under the GDPR drop more vendors. Websites are more likely to drop smaller vendors, which increases the relative concentration of the vendor market by 17%. Increased concentration predominantly arises among vendors that use personal data such as cookies, and from the increased relative shares of Facebook and Google-owned vendors, but not from website consent requests. This suggests that increases in concentration are driven by website vendor choices rather than changes in user behavior