Does Privacy Regulation Harm Content Providers? A Longitudinal Analysis of the Impact of the GDPR

While the European General Data Protection Regulation (GDPR) has received sig-nificant attention in the information systems literature, concerns that it would adverselyaffect  websites’  ability  to  provide  quality  content  to  their  visitors  have  not  been  thor-oughly investigated.  We construct a longitudinal data-set of news and media websites tostudy how online content providers adapted their responses to the GDPR over time, andwhether  restrictions  on  online  tracking  enforced  by  the  regulation  affected  downstreamoutcomes  such  as  the  quantity  of  content  those  websites  offer  to  their  visitors  and  vis-itors’ engagement with such content.  We find robust evidence of websites’ reactions tothe GDPR in both the US and the EU, including an initial reduction in the number ofthird-party  cookies  and  intensity  of  visitor  tracking.   However,  reactions  differ  betweenUS and EU websites, and several months after the enactment of the regulation the initialreduction in tracking is reversed, as tracking among EU websites bounces back.  We usedifference-in-differences,  LATE,  and  look-ahead  matching  models  to  assess  downstreameffects of the regulation, capturing both ecosystem effects and website-level effects.  Wefind a small reduction in average page views per visitor on EU websites relative to USwebsites near the end of the period of observation, but no statistically significant impactof the regulation on EU websites’ provision of new content, social media engagement withnew  content,  and  ranking  in  both  the  short-term  and  the  long-term.   We  also  find  noevidence of differences in survival rates across EU and US content providers, and no evi-dence that monetization strategies change at a higher rate for EU websites relative to USwebsites.  While industry predictions forebode dire consequences arising from the GDPRfor content providers, we find that websites that responded more strongly to the GDPRwere those less likely to be affected by such a response; in contrast, websites that reliedin great part on EU visitors found, over time, ways to avoid being negatively affected bythe regulation.