Thread by @garjoh_canuck

🚨Working paper update!🚨
🧵Post-#GDPR, website use of tech vendors fell 15% but relative concentration increased 17%.

"Privacy & market concentration: Intended & unintended consequences of the GDPR” w/ Scott Shriver & @samgarvingold
ssrn.com/abstract=34776…
(Image: Digiday) 1/14

Privacy and competition top today’s policy agenda particularly in tech. Google & Facebook capture 56% of global digital ad spend. They also face regulatory scrutiny on both sides of the Atlantic on both counts.
But, could #privacy policy actually reduce #competition? 2/

How? Large firms could have more resources to comply with the law or leverage firm recognition to better obtain consumer consent.
New: If privacy law pushes firms to limit data vendors, firms may favor retaining large vendor that offer better products (or compliance). 3/

We study tech vendors used by 27K top sites over 2018. We identify site-vendor ties by vendor's 3rd party domain interactions (e.g. cookies) when visiting the site.

Examples: google-analytics.com -> Google Analytics
demdex.net -> Adobe Audience Manager 4/

Sites reduce vendor use 15% on average *one week* post-GDPR.
But, vendor use returns to pre-GDPR levels by end of 2018. Why?
1) Site beliefs about chance of enforcement fall (no enforcement in this sector in 2018)
2) Innovation: site vendor use has increased for decades. 5/

We rule out alternative explanations.
Vendor use does not fall because sites block EU users, consent management systems interfere with our data collection, or vendors exit.
Bounce-back is not just sites adding back same vendors. End of 2018 does not reflect compliance. 6/

So, we focus on 1 week post- vs pre-GDPR comparison where #GDPR effect is largest.
Breaking vendors by purpose, we see that each category falls but "privacy compliance” vendors (makes sense). Note: EU regulators single out #adtech and this category falls the most: 24.1%. 7/

So, do large vendors get a bigger share of the smaller pie?
- Overall, relative concentration (HHI) in web tech rises 17% 1 week post-#GDPR.
- So does top 4 web tech categories (94% of data): #adtech HHI rises 25%
- But, some niche categories are exceptions. 8/

Why? 1st, we see more concentration among vendors that likely use personal data, which the #GDPR targets. So, the pool of online personal data shrinks & becomes more concentrated in hands of large vendor. If this data creates value, this could further entrench large vendors. 9/

2nd, The #GDPR’s consent requirement may push sites to work fewer vendors & large, recognizable vendors. But, increase in concentration is about the same for sites that do/don’t get consent. This makes sense: sites bury vendor list under “more options.” 10/

3rd, without Google & Facebook, relative concentration actually *falls* post-#GDPR.
This does not imply Big 2 are bad:
-Their *absolute* shares of sites falls post-GDPR
-Sites may favor large vendors because they have better products or better compliance (good things). 11/

We model sites choice of vendors as an economic decision. Sites with 0% to 20% traffic from EU cut vendors most: they have little to gain from monetizing few EU users, but lots to lose from GDPR's 4% fine on *global* revenue.
So, sites with more EU users cut vendors less!🤯 12/

We also examined the role of enforcement beliefs. Sites in countries with stricter data regulators (think: Germany & Sweden) return to pre-#GDPR vendor levels by Dec. `18, but sites in laxer countries (think: Bulgaria & Greece) do so by the end of July `18! 13/

IN SUM, *this does not imply* GDPR or privacy policy are bad.
But understanding #GDPR's consequences can improve policy.
Intended: less web vendor use & data sharing
Unintended: 1) more market concentration
2) sites with most EU visitors reduce vendors the least
(Image: Vox) END