This will be interesting: The Wall Street Journal reports that the Federal Trade Commission (FTC) is about to launch a rulemaking to ramp up regulation of Big Tech’s collection and use of user data. FTC Chair Lina Khan says this is keeping with the agency’s missions of consumer protection and promotion of competition. But there is solid economic research showing that such regulations often have the opposite effect — namely harming consumers and protecting large businesses from competition.
One of the latest pieces of said evidence was a paper presented at the FTC’s recent microeconomics conference. The authors — a doctoral student from Northwestern University and two marketing professors from Boston University and the University of Colorado, respectively — examined the impacts of the European Union’s (EU) General Data Protection Regulation (GDPR), which sets guidelines for how any organization offering goods or services in Europe collects and processes personal information from EU citizens. GDPR, which went into effect in May 2018, has global reach: The University of Florida (where I teach) changed its data management policies to satisfy the regulations.
The research examined how GDPR affects web use and e-commerce, and discovered that the amounts measured fell 11.7 percent and 13.3 percent respectively following GDPR’s implementation. The researchers found that some portion of these declines resulted from GDPR decreasing the value of internet usage. The remaining portions resulted from GDPR allowing internet users to opt out of tracking and data gathering.
The researchers also found that GDPR harms competition by giving advantages to larger businesses. They write, “Smaller e-commerce sites see twice the decline in recorded revenue (–17.4%) than larger sites (–8.9%)” because the smaller sites have a harder time obtaining user consent. If Khan is right that “concentrated control over data has enabled dominant firms to capture markets and erect entry barriers,” then the new FTC regulations could exacerbate the problem.
This paper is simply the latest in a line of research finding that GDPR negatively affects consumers and businesses, especially small businesses. Two of the earliest studies found that GDPR decreased venture capital availability in the EU, especially for newer, data-related, and consumer-facing ventures. Another study found that GDPR increased “market concentration among technology vendors that provide support services to websites.” Another found that “websites reduced their connections to web technology providers after GDPR” and that firms offering such services generally lost market share to Google. Yet another found that GDPR caused traffic to EU websites to decline 4 percent relative to US sites.
Supporters of GDPR-like regulations may celebrate these findings, arguing that the EU’s intent was to decrease data collection and use and that decreased e-commerce and web use is a natural and good result. Google might agree given that it grew relative to its rivals under these regulations, but it is unclear that consumers and small businesses would agree: It is unlikely that consumers opting out of tracking foresee that their choices decrease the value of their web experiences. And small businesses see higher costs and less revenue.
It might be tempting for groups cheering Khan’s push for a rulemaking on Big Tech data practices to argue that the FTC can avoid GDPR’s pitfalls and provide a win-win for consumers and competition. This is unlikely: GDPR favors large firms because compliance is more costly for small firms than for large ones. This is generally true for regulations. And privacy regulations accentuate large firms’ big data advantages by restricting small firms’ data-gathering abilities.
Given that leading progressive Democratic Senators and Khan seem to be of the same mind, the FTC will likely press forward with data regulations despite a clear conflict with the agency’s core mission. There is some belief that the FTC lacks authority for such a rulemaking. Just in case it does, people with knowledge would do well to ensure that the FTC’s record in the rulemaking is well-populated with substantive research.
Finally, the FTC is to be commended for hosting research conferences that allow papers whose conclusions differ from some commissioners’ policy preferences. America is better for it.
(Disclosure statement: Mark Jamison provided consulting for Google in 2012 regarding whether Google should be considered a public utility.)
