GDPR reading (abstract and intro only)

Overview

Based on the Abstract and Introduction of the provided paper, here is an in-depth, study-friendly explanation of the research.

Overview: The GDPR's Double-Edged Sword

The General Data Protection Regulation (GDPR) is a major privacy law from the European Union designed to protect user data. While the law succeeded in its primary goal (reducing data sharing), this paper argues it had a significant unintended consequence: it made the market for web technology vendors more concentrated.

In simpler terms: Privacy laws might accidentally help big tech companies (like Google and Facebook) get bigger while hurting smaller competitors.

The Core Problem: Privacy vs. Competition

1. The Core Problem: Privacy vs. Competition

Academics and policymakers are worried about a trade-off between protecting privacy and maintaining a competitive market. The authors highlight why strict privacy regulations might favor large companies:

• Resources: Large firms have more money and technical teams to handle complex compliance rules.

• Consent: Big companies interact directly with more consumers, making it easier for them to get users to click "I agree" on data tracking.

• Business-to-Business (B2B) Bias: Websites might prefer working with large vendors because they are seen as "safer" legal bets. If a website uses a small, unknown vendor, they might worry about that vendor breaking the law and causing legal trouble

The Study Setting: Web Technology Vendors

The researchers focused on the market for "web technology vendors." These are the third-party companies that provide services to websites behind the scenes.

• What do these vendors do? They help websites show ads, host videos, track visitor statistics (analytics), and enable social media sharing.

• Why are they regulated? These vendors process massive amounts of personal data (like tracking cookies), which puts them directly in the crosshairs of the GDPR.

• Who dominates? Google and Facebook are the giants here, capturing 56% of global digital advertising spending.

The Methodology: How They Measured It

To see the real-world impact of the GDPR, the researchers treated the law's enforcement date (May 25, 2018) as a specific event to analyze.

• Data Collection: They looked at over 27,000 top websites from the EU, US, Canada, and globally.

• Technique: Throughout 2018, they used a specialized tool to scan these websites. Crucially, they used a VPN to appear as a French user to ensure they were seeing how websites treated visitors protected by EU law.

• Observation: They tracked which third-party vendors these websites were using before and after the GDPR went into effect.

Key Findings (The Results)

The study reveals two main shifts that occurred immediately after the GDPR was enforced:

A. Intended Consequence: Less Data Sharing

The law worked as intended. One week after enforcement, websites dropped about 15% of their technology vendors for EU users.

• Why? Websites faced a choice: keeping a vendor meant risking a penalty. Websites with higher visibility (more traffic, more ads) cut more vendors because they faced higher risks of being fined.

B. Unintended Consequence: Increased Market Concentration

The law hurt competition. When websites cut vendors, they didn't cut them randomly. They mostly dropped smaller vendors.

• Market Concentration: The relative concentration of the vendor market increased by 17%.

• Who Won? The market share shifted toward:

  1. Vendors that use personal data (like cookies).

  2. Google and Facebook, whose dominance became even more entrenched.

• The Driver: This concentration wasn't caused by users changing their behavior (e.g., clicking different consent buttons). It was driven by websites choosing to drop small vendors to minimize their own legal risk.

Why This Matters

This research adds to a growing body of evidence suggesting that regulations often have side effects. Just as advertising bans in the past accidentally helped big tobacco or alcohol companies keep their market share, privacy laws might be insulating Big Tech from competition .

By making it harder and riskier to share data, the GDPR may have inadvertently strengthened the biggest players in the digital economy.