Thread by @garjoh_canuck

🚨New working paper alert!🚨
THREAD: Post-#GDPR, website use of web tech vendors falls 15% but relative concentration increases 17%.

"Privacy & market concentration: Intended & unintended consequences of the GDPR” w/ Scott Shriver
ssrn.com/abstract=34776…
(Image: Digiday) 1/

Privacy and competition top today’s policy agenda—particularly in web tech which relies on permissive privacy practices and where big companies like Google & Facebook have large market share.

But, could #privacy policy actually reduce #competition ? 2/

How? Large firms could have more resources to comply with the law or leverage firm recognition to better obtain consumer consent. We add that potential B2B partners could favor large firms if 1) they offer a superior product; or 2) they better comply with the law. 3/

Data minimization is a key principle of #GDPR & its many elements incentivize this by increasing cost of personal data to business. So, when firms limit B2B data vendors to comply, do firms favour the big or the little vendors?
4/

We examine the web tech vendors used by 27K top sites over 2018. We identify site-vendor ties by vendor's 3rd party domain interactions (e.g. cookies) when visiting the site.
Example:
google-analytics.com ->Google Analytics
demdex.net ->Adobe Audience Manager 5/

We find that find that sites use 15% fewer vendors on average *one week* post-#GDPR. These compliance gains are short lived: by the end of 2018, average web tech vendor use returns to pre-GDPR levels. 6/

Breaking vendors by purpose, we see that each falls but "privacy compliance” vendors (makes sense).

We focus on 1 week post- vs pre-GDPR comparison where #GDPR effect is largest, because regulator signalled intent to clamp down on sector in 2020. 7/

So, do large vendors get a bigger share of the smaller pie?
- Overall, relative concentration in web tech rises 17%.
- So does top 4 web tech categories (*94% of data*).
- But, some niche categories are exceptions. 8/

Why? 1st, we see more concentration among vendors that likely use personal data, which the #GDPR targets. So, the pool of online personal data shrinks & becomes more concentrated in hands of large vendor. If this data creates value, this could further entrench large vendors. 9/

2nd, The #GDPR’s consent requirement may push publishers to work fewer vendors & large, recognizable vendors. But, increase in concentration is about the same for sites that do/don’t get consent. This makes sense: publishers often bury vendor list under “more options”. 10/

3rd, Google’s many vendors & Facebook play a key role: sites retain these over competitors post-GDPR at high rates. Without the Big 2, relative concentration actually *falls* post-#GDPR. Still, Google & Facebook's *absolute* share of sites falls post-GDPR. 11/

*This does not imply* GDPR or privacy policy are bad. But, understanding #GDPR's intended & unintended consequences can improve regulation & policy. #GPDR does not always increase concentration here, but it does in aggregate & for top web tech categories. (Image: Vox) 12/

*This does not imply* Google & Facebook are bad either. Big 2 are better on a relative basis, but worse on an absolute basis. Concentration appears to result from site choices. If large vendors have better products or better compliance (good things), sites could favor them. 13/13

FAQ: Why focus on short run?
The evolutions of relative concentration and vendors mirror each other in 2018.
Short run estimates have most signal & may better indicate industry under future enforcement because EU regulators signalled they will intervene in web technology.