We provide a theoretical model of privacy in which data collection requires consumers’ consent and consumers are fully aware of the consequences of such consent. Nonetheless, excessive collection of personal information arises in the monopoly market equilibrium which results in excessive loss of privacy compared to the social optimum. The main mechanism for this result is information externalities and users’ coordination failure in which some users’ decision to share their personal information may allow the data controller to infer more information about non-users. We also show that the emergence of data brokerage industry can facilitate the collection and monetization of users’ personal data even in a fragmented market where no individual website has incentives to do so independently due to scale economies in data analytics. We discuss policy implications of our analysis in light of the recent EU General Data Protection Regulation (GDPR).
Bibliographical noteFunding Information:
We thank Jacques Crémer, Alexandre de Cornière, Saara Hämäläinen, Christian Peukert, David Laband, Marc Lebourges, Yassine Lefouili, Jean Tirole, Liad Wagman, and conference and seminar participants at the 2018 KEA-KAEA International conference, 2018 Mannheim Workshop “Governance of Platform Markets in the ‘Big Data’ Era”, 2017 IIOC, 2017 IDEI-TSE-IAST conference on “The Economics of Intellectual Property, Software and the Internet,” Academia Sinica, Auburn U, Korea U, U of Seoul, U of Central Florida, Toulouse School of Economics, and U of Alabama for helpful comments. We are also grateful to an anonymous referee and the Co-Editor Kai Konrad for constructive comments and guidance which greatly improved this article. Jay Pil Choi’s research was supported by the National Research Foundation of Korea Grant funded by the Korean Government ( NRF-2016S1A5A2A01022389 ).
All Science Journal Classification (ASJC) codes
- Economics and Econometrics