Privacy Risk and Competitive Data Protection Investment with Behavior-Based Pricing

This paper explores firms’ incentives to invest in data protection to mitigate the risk of compromising consumer privacy, in the context of duopoly competition with behavior-based pricing. We highlight the unique nature of privacy protection as a product characteristic, which distinguishes a firm’s investment in privacy protection from standard improvement in product quality. The analysis uncovers an inverted U-shaped relationship between firms’ provision of data protection and privacy leak risk. We show that firms can be worse-off with a decrease in the privacy leak risk. Our analysis of consumer welfare suggests a free-market solution to consumer privacy protection if the privacy leak risk is low and supports privacy regulations otherwise. An important policy implication is that a moderate regulatory effort to improve consumer privacy protection may backfire and reduce consumer welfare in markets with a high risk of privacy leaks. In the extensions, we show that increase in consumer loyalty or growth of consumer demand may result in reduced investment in firms’ data protection. Therefore, policymakers aiming at enhancing consumer privacy protection should watch closely in such situations