Impact of Privacy Laws on Businesses

                                        Created with Microsoft Bing Image Creator powered by DALL-E

How Have Privacy Protection Laws Impacted Businesses? 

        As more privacy protection legislation is developed and enacted globally, the question that frequently arises is what kind of impact such new regulation has on businesses? Merely from the fact regulation creates more limits to companies on how they can utilize personal data, there is undoubtedly a negative impact, but whether there are only negative impacts, and whether all companies are affected equally, is more nuanced. 

Key Takeaways: 

- Companies have been negatively impacted, with reduced profits and sales, declines in new ventures and app development, and reduced efficiency. 
- Larger companies have generally been less impacted than small and medium companies. 
- Awareness and opt-in consent to using data may have resulted in more accurate ad targeting for those consumers that still opted-in. 
- Flexibility in data strategy and using more varied data technologies can improve companies' adaptability to new privacy regulations. 

Have companies been negatively impacted? 

        Surveys suggest that companies, generally speaking, have been negatively impacted by new privacy legislation such as the GDPR. GDPR is argued to have limited competition in data markets by concentrating market structures and entrenching the market power of those who are already strong, while also limiting data sharing between various data collectors and processors which further reduced synergy and efficiency. This finding is supported by a different study on the impact of GDPR on firms' profits and sales, which found an 8% reduction in profits and 2% reduction in sales. Moreover, this study also found that the largest reductions were in small or medium sized companies, whereas major companies like Facebook and Google did not show any measurable reduction in sales or profits. An MIT study similarly found that smaller advertisers that depended on third party access were put at a disadvantage after the GDPR mandated opt-in consent for data tracking and collection. 

        More specific examples include a significant decline in new EU ventures, especially for foreign investment, younger ventures, and data-reliant firms. This study found a 26.1% decline in monthly EU deals and 33.8% reduction in the average dollar raised per deal. That being said, the decline in foreign investment may be a temporary effect due to the GDPR being the only major regulation of its kind when it was first introduced. As more privacy legislation is enacted globally, and foreign investors begin to face privacy legislation in most countries, it is likely this drop in foreign investment will diminish in impact. 

        Additionally, new app development has also declined, with new app entries falling by 47% and successful new entries among those entered also falling by 40%. This decline is attributed to the GDPR making app development more time-consuming and costly, as well as developers opting to remove apps that may trigger the GDPR rather than attempting to adapt to it. 

Are there any positive impacts from new privacy legislation? 

        Although studies indicated that major companies were not as affected by privacy legislation, the GDPR and similar legislation have had a different impact on such major companies through the enforcement of fines. GDPR's privacy officers have become well known for imposing billions of dollars in fines on major companies such as Google and Meta for violations of GDPR. Other privacy regulation agencies in different countries have begun to emulate this, with a recent example being Korea's 6.6M won fine on Meta for disadvantaging customers that refused to provide personal information. Such fines and enforced compliance to privacy legislation on major companies have greatly reduced the risk and exploitation of personal data while upholding privacy rights. 

        There is also a trend away from privacy-intrusive apps(even if they abide by the GDPR), with apps requesting at least one type of privacy-sensitive data taking up 47% of all apps compared to 57% before the GDPR. 

        Aside from the obvious privacy benefits to the people, there are also some benefits to privacy legislation. An MIT study found that although the opt-in requirement for tracking consumers in the GDPR resulted in a 12.5% drop in privacy-concerned consumers, the remaining consumers remained trackable for longer and gave more accurate targeting data. This was demonstrated by an initial drop in clicks per ad following the GPDR, followed by a gradual recovery and eventual increase in average bids on targeted ads, which allowed at least a part of the lost revenue to be recovered. However, this study also noted that the improved opt-in targetting may benefit consumers by allowing better ad targetting that met their needs, but may also extract the consumer surplus (such as through personalized pricing), which would be beneficial for businesses but less so for consumers. 

How can companies better adapt to privacy laws? 

        The Harvard Business Review (HBR) suggests that the key may be in emphasizing flexibility regarding data strategy and using various loosely integrated technologies. The HBR reported that privacy requirements in the EU's GDPR and US state privacy laws have reduced the flexibility and efficiency of businesses' Information-Technology(IT) infrastructure, in particular technologies that facilitate the exchange and use of customer data. The example they give is using Google Analytics to track customer behavior, then using email marketing tactics on them through Mailchimp, and reviewing the successfulness of that tactic through Google Analytics. Such interdependent tech, however, involves sharing data across multiple technologies or companies, which can become a problem with privacy laws. HBR's report noted that companies that focused on flexibility and using a wide variety of interchangeable digital solutions played a significant role in helping companies adapt to the GDPR, and thereby played as important a role as pure efficiency in utilizing consumer data.

Conclusion: 

        Although the new privacy regulations have resulted in a negative impact for most businesses, these are to be considered necessary losses to ensure the protection of privacy rights and minimize the risk of having one's personal data be misused and exploited. Just as workplace safety regulations have greatly reduced health hazards for labourers at the cost of 'inefficiency' in factories, privacy regulations can be viewed in the same light. The priority of companies, then, should be on how best to prepare for and adapt to privacy regulations as they become globally accepted and standardized.