Here’s something to ponder as CCPA looms in California: GDPR has led to several unexpected outcomes, including vendor consolidation.
That’s the main finding of “Privacy & market concentration: intended & unintended consequences of the GDPR,” a paper by Garrett A. Johnson of the Questrom School of Business, and Scott Shriver of the Department of Marketing at the University of Colorado at Boulder.
On the one hand, GDPR has minimized collection of personal data, although that has eroded slightly. But that has fed consolidation.
Large firms have “more technical and financial resources to comply with regulation,” the study explains, quoting other research. And large firms can “leverage firm recognition to better obtain individual consent,” it adds.
Whatever the cause, GDPR has led to a "tradeoff between privacy regulation and market concentration,” the authors note. And this in turn “compounds concerns about market power in the economy," they continue.
The week after implementation, the number of web technology vendors being used fell by 15%--a temporary falloff.
In the short run, “concentration “increases 17% in aggregate and in each of the top four web technology categories that represent 94% of website-vendor ties: advertising, hosting, audience measurement, and social media,” the study states.
Advertising, the largest category has fallen the most — by 24.3%, from 4.35 to 3.29 average vendors.
Hosting has declined by 9.7%, while audience management has fallen by 10.9% and social media has dropped by 11.5%.
This trend also carries over to B2B. “Potential business partners could favor large vendors because they may offer a superior product or they may limit legal risk by offering superior regulatory compliance,” the authors continue.
Concentration is highest among “the web technology vendors using the personal data that the GDPR targets,” the study continues. However, consent does not appear to be feeding it.
Who does this help the most? Guess. “The giants like Web technology’s largest companies — Google and Facebook — capture 56% of global digital advertising spend. But it says that “Google and Facebook also face privacy and competition scrutiny.”
We’ll see whether CCPA has the same impact. In the meantime, the authors conclude that “as policymakers wrestle with how to protect individual privacy, they should balance the risk of increasing concentration of personal data ownership and increasing market power.”
The authors examined over 27,000 top websites with a baseline of over 375,000 website-vendor ties.