Privacy law as price control


The median Internet user is concerned about digital advertisers collecting personal information. To address these fears, the European Union passed the Privacy Directive to regulate the common business practice of information collection. This paper investigates the potential effects of this regulation, finding that the law is likely to generate several unintended consequences. Economists and legal scholars acknowledge that personal data serves as the “price” for accessing many digital platforms. I extend this logic to argue that if a regulation enables consumers to stop supplying this information, while continuing to consume the site’s content, it is equivalent to a price control. Next, I discuss unintended consequences that this price control may generate: tie-in sales, investment flight, and altered exchange characteristics. Lastly, I conclude that, just as with traditional price controls, the privacy price control may be a way for government officials to enhance their popularity with the citizenry. In short, my analysis suggests that one of the most well-researched policy interests of economics—the theory of price controls—can shed light on one of economists’ newest interests: digital privacy.

This is a preview of subscription content, log in to check access.


  1. 1.

    Note that firms themselves may collect information as in the case of Google saving all searches. Alternatively, firms may simply serve as the platform that enables advertisers to collect information.

  2. 2.

    There are many different conceptions of privacy, however, even within economics. For example, Hirshleifer (1980) critiques the Posner-Stigler conception. As Tucker (2016) states: “Economics has struggled to arrive at a unified theory of privacy.” Solove, a legal scholar, concurs: “Privacy is a concept in disarray,” 2006. Thomson (1975) observes: “Perhaps the most striking thing about the right to privacy is that nobody seems to have a very clear idea what it is.”

  3. 3.

    Some have noted that self-regulation, a way of establishing industry standards, is an alternative to government regulation. Most evaluations of self-regulation of digital privacy, however, have been negative (Swire 1997; Hoofnagle 2005; Hirsch 2010).

  4. 4.

    It seems just as plausible, on the grounds of behavioral economics, that consumers might over-value their privacy. After all, a standard result in the behavioral economics literature is that individuals may over-estimate the probability of rare events, such as a privacy breach.

  5. 5.

    Stigler and Posner examine broader privacy regulation, rather than digital privacy regulation specifically, but their analysis is applicable to the digital environment.

  6. 6.

    The topic of “data breaches” might be better categorized as a “cybersecurity” issue.

  7. 7.

    Farrell concludes that privacy is best analyzed as a final good rather than an intermediate good sought for the end of achieving some other good.

  8. 8.

    Other companies, like Facebook, voluntarily implement an opt-in default in which service is conditional on surrendering certain personal information. Given that these firms have already implemented opt-in, we would expect them to be relatively less adversely impacted by a mandated opt-in.

  9. 9.

    See Cheung (1974) for a survey of the literature on price controls.

  10. 10.

    Consumers may indeed be unaware of all the uses to which a firm collecting their data will put it. Given that they continue to visit such sites, however, the costs of discovering this information must outweigh the benefits they receive from visiting the website. The presence of information asymmetry does not change the fact that this is an exchange between firms and consumers. Consumers can refrain from the exchange if they are made uncomfortable by the lack of information, just as someone could refrain from purchasing a used car for the same reason.

  11. 11.

    Of course, beyond a point, additional users increase the probability of a website crashing.

  12. 12.

    There is no overarching, federal digital privacy law in the US. However, Japan, China, South Africa, and Singapore have joined the EU in regulating digital privacy at the national level.

  13. 13.

    Even in the case where “consent” is interpreted to mean that the the visitor’s default browser settings accept cookies, the logic of price control is still applicable. After all, a browser may change her browser’s default settings, especially if prompted by a pop-up privacy notice. Most consumers will not change their default settings, but the law does alter the total number of consumers paying the full price.

  14. 14.

    “Effectiveness” was measured as the “stated intention to buy” the product that had been advertised.

  15. 15.

    Though rent control exists all over the world, there is large variance in enforcement between locales (Arnott 1995, p. 100).

  16. 16.

    Any empirical investigation of a shift to fee-based services must be careful to distinguish market-driven adoption of such business models from adoption following as a direct consequence of regulation.

  17. 17.

    Intuition suggests that laws curtailing the use of targeted advertising will cause revenue to Internet platforms to fall because digital advertisers are willing to pay less for non-optimized ad space. Hummel and McAfee (2015) show theoretically, however, that targeted ads can, under very specific conditions, reduce the revenue to the platform firm. Such a result follows from the combination of highly-optimized targeting and a few dominant bidders for ad space.

  18. 18.

    One possible complication is the “EU-US Privacy Shield,” which replaces the “International Safe Harbor Privacy Principles.” The “Shield” governs the transfer of EU-citizen data from the EU to the US. The “Shield” is legally contested and applies to “personally identifiable information” (PII). As Goldfarb and Tucker (2011) note, it is not clear whether “clickstream data” should be categorized as PII or not. Nonetheless, as Goldfarb and Tucker (2011) find, there is a difference between US websites and EU websites regarding the quality of information they are able to collect from an EU browser. This suggests that, at least in practice, there is a significant difference between the way the EU rules apply to US and EU firms.

  19. 19.

    Here I am concerned with counterintuitive results, and not simply with those that we might most easily predict. For example, one might easily imagine that regulation causes consumers to be faced with the same number of ads, only that these ads are less targeted. Even whether this is a welfare gain is itself questionable because it raises the search cost of a consumer finding a product (Varian 1996).

  20. 20.

    This is also contrary to Weyl (2009) who predicts that a price control imposed on one side of a two-sided market will result in a price increase on the other side of the market. Here, the prices that advertisers’ willingness to pay likely falls. Of course, this logic does not run counter to Weyl; it simply demonstrates another peculiarity of the price control when information, rather than money, is the medium of exchange.

  21. 21.

    The 2012 Adobe survey finds that 68% of web users see banner ads as “distracting.”


  1. Acquisti, A. (2012). Privacy and market failures: Three reasons for concern, and three reasons for hope. Journal on Telecommunications and High Technology Law, 10, 227.

    Google Scholar 

  2. Acquisti, A., & Grossklags, J. (2007). What can behavioral economics teach us about privacy. In Digital privacy: Theory, technologies and practices (pp. 363–377).

  3. Acquisti, A., & Varian, H. R. (2005). Conditioning prices on purchase history. Marketing Science, 24(3), 367–381.

    Article  Google Scholar 

  4. Acquisti, A., Taylor, C., & Wagman, L. (2016). The economics of privacy. Journal of Economic Literature, 54(2), 442–492.

    Article  Google Scholar 

  5. Adobe. (2012). Click here: The state of online advertising. Accessed 10/25/2016.

  6. Alchian, A.A. (1967). Pricing and society. Institute of Economic Affairs.

  7. Alston, R. M., Kearl, J. R., & Vaughan, M. B. (1992). Is there a consensus among economists in the 1990’s? The American Economic Review, 82(2), 203–209.

    Google Scholar 

  8. Arnott, R. (1995). Time for revisionism on rent control? The Journal of Economic Perspectives, 9(1), 99–120.

    Article  Google Scholar 

  9. Barzel, Y. (1997). Economic analysis of property rights. Cambridge: Cambridge University Press.

    Google Scholar 

  10. Baumer, D. L., Earp, J. B., & Poindexter, J. (2004). Internet privacy law: A comparison between the united states and the european union. Computers and Security, 23(5), 400–412.

    Article  Google Scholar 

  11. Bergkamp, L. (2002). EU data protection policy: The privacy fallacy: Adverse effects of europe’s data protection policy in an information-driven economy. Computer Law and Security Review, 18(1), 31–47.

    Article  Google Scholar 

  12. Boettke, P. (2001). Economic calculation: The Austrian contribution to political economy. In P. Boettke (Ed.), Calculation and coordination: Essays on socialism and transitional political economy.

  13. Borgesius, F. J. Z. (2015). Improving privacy protection in the area of behavioural targeting. Philadelphia: Wolters Kluwer Law and Business.

    Google Scholar 

  14. Buchanan, J. M. (2008). Same players, different game: How better rules make better politics. Constitutional Political Economy, 19(3), 171–179.

    Article  Google Scholar 

  15. Burke, M., Hornof, A., Nilsen, E., & Gorman, N. (2005). High-cost banner blindness: Ads increase perceived workload, hinder visual search, and are forgotten. ACM Transactions on Computer-Human Interaction (TOCHI), 12(4), 423–445.

    Article  Google Scholar 

  16. Campbell, J., Goldfarb, A., & Tucker, C. (2015). Privacy regulation and market structure. Journal of Economics and Management Strategy, 24(1), 47–73.

    Article  Google Scholar 

  17. Cheung, S. N. (1974). Theory of price control. The Journal of Law and Economics, 17, 53.

    Article  Google Scholar 

  18. De Corniere, A., & De Nijs, R. (2016). Online advertising and privacy. The RAND Journal of Economics, 47(1), 48–72.

    Article  Google Scholar 

  19. EU (2002). Directive on privacy and electronic communications. Accessed 3/25/17.

  20. EU (2016). General data protection regulation. Accessed 3/14/17.

  21. Facebook (2016). Company info. Accessed 10/20/2016.

  22. Farrell, J. (2012). Can privacy be just another good. Journal on Telecommunications and High Technology Law, 10, 251.

    Google Scholar 

  23. Fulgoni, G., Morn, M., & Shaw, M. (2010). How online advertising works: Whither the click in europe. Accessed 10/20/2016.

  24. Fuller., C. S. (2017). The perils of privacy regulation. The Review of Austrian Economics, 30(2), 193–214.

    Article  Google Scholar 

  25. Gellman, R. (2002). Privacy, consumers, and costs: How the lack of privacy costs consumers and why business studies of privacy costs are biased and incomplete. Accessed 10/15/2016.

  26. Gertz, J. D. (2002). Purloined personality: Consumer profiling in financial services. The San Diego Law Review, 39, 943.

    Google Scholar 

  27. Gneezy, U., & Rustichini, A. (2000). Fine is a price. The Journal of Legal Studies, 29, 1.

    Article  Google Scholar 

  28. Goldfarb, A., & Tucker, C. E. (2011). Privacy regulation and online advertising. Management Science, 57(1), 57–71.

    Article  Google Scholar 

  29. Handrahan, M. (2016). Iap the least popular form of monetisation among playrs. Accessed 10/24/16.

  30. Hanson, R. (2003). Warning labels as cheap-talk: Why regulators ban drugs. Journal of Public Economics, 87(9), 2013–2029.

    Article  Google Scholar 

  31. Hayek, F. A. (1945). The use of knowledge in society. The American Economic Review, 35, 519–530.

    Google Scholar 

  32. Hermalin, B. E., & Katz, M. L. (2006). Privacy, property rights and efficiency: The economics of privacy as secrecy. Quantitative Marketing and Economics, 4(3), 209–239.

    Article  Google Scholar 

  33. Hirsch, D. D. (2010). Law and policy of online privacy: Regulation, self-regulation, or co-regulation. The Seattle University Law Review, 34, 439.

    Google Scholar 

  34. Hirshleifer, J. (1980). Privacy: Its origin, function, and future. The Journal of Legal Studies, 9(4), 649–664.

    Article  Google Scholar 

  35. Hoofnagle, C. J. (2003). Reflections on the nc jolt symposium: The privacy self-regulation race to the bottom. NC Journal of Law and Technology, 5, 213.

    Google Scholar 

  36. Hoofnagle, C. J. (2005). Privacy self regulation: A decade of disappointment. In J. K. Winn (Ed.), Consumer protection in the age of the ‘information economy. Farnham: Ashgate.

    Google Scholar 

  37. Hoofnagle, C.J., Whittington, J. (2014). Free: Accounting for the costs of the internet’s most popular price. UCLA Law Review, 61(2013), 606.

    Google Scholar 

  38. Hui, K.L., Png, I.P. (2005). Economics of privacy. In Handbook of information systems and economics.

  39. Hummel, P., McAfee, R.P. (2015). When does improved targeting increase revenue? In Proceedings of the 24th International Conference on World Wide Web, International World Wide Web Conferences Steering Committee, pp 462–472.

  40. Jenkins, B. (2009). Rent control: Do economists agree? Econ Journal Watch, 6(1), 73–112.

    Google Scholar 

  41. Johnson, B. (2010). Privacy’s dead: Facebook chief. Accessed 10/24/16.

  42. Kesan, J. P., & Gallo, A. A. (2006). Why are the united states and the european union failing to regulate the internet efficiently? Going beyond the bottom-up and top-down alternatives. European Journal of Law and Economics, 21(3), 237–266.

    Article  Google Scholar 

  43. Khan, I., Weishaar, B., Karasyov, V., Polinsky, L., Boushelle, J. (2007). The rise of ad networks: An in-depth look at ad networks. Accessed 10/25/2016.

  44. Kim, J. H., & Wagman, L. (2015). Screening incentives and privacy protection in financial markets: A theoretical and empirical analysis. The RAND Journal of Economics, 46(1), 1–22.

    Article  Google Scholar 

  45. Kincaid, J. (2009). Startup school: Wired editor chris anderson on freemium business models. Accessed 10/24/2016.

  46. Kohnstamm, J. (2013). Working document 02/2013 providing guidance on obtaining consent for cookies. Accessed 3/14/17.

  47. Lenard, T.M., Rubin, P.H. (2009). In defense of data: Information and the costs of privacy. Technology Policy Institute Working Paper pp 9–44.

  48. Lerner, J. (2012). The impact of privacy policy changes on venture capital investment in online advertising companies. Analysis Group pp 1–2.

  49. Lott, J. R., & Roberts, R. D. (1989). Why comply: One-sided enforcement of price controls and victimless crime laws. The Journal of Legal Studies, 18(2), 403–414.

    Article  Google Scholar 

  50. Madden, M., Rainie, L. (2015). American attitudes about privacy, security, and surveillance. Accessed 10/24/2016.

  51. Milberg, S. J., Smith, H. J., & Burke, S. J. (2000). Information privacy: Corporate management and national regulation. Organization Science, 11(1), 35–57.

    Article  Google Scholar 

  52. Newman, N. (2014). The costs of lost privacy: Consumer harm and rising economic inequality in the age of google. William Mitchell Law Review, 40(2), 849–1611.

    Google Scholar 

  53. Ohm, P. (2010). Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law Review, 57, 1701.

    Google Scholar 

  54. Pasquale, F. (2012). Privacy, antitrust, and power. George Mason Law Review, 20, 1009.

    Google Scholar 

  55. Peppet, S. R. (2011). Unraveling privacy: The personal prospectus and the threat of a full-disclosure future. Northwestern University Law Review, 105, 1153.

    Google Scholar 

  56. Posner, R. A. (1977). The Right of privacy. Georgia Law Review, 12, 393.

    Google Scholar 

  57. Posner, R. A. (1981). The economics of privacy. The American Economic Review, 71(2), 405–409.

    Google Scholar 

  58. Rochelandet, F., & Tai, S. H. (2012). Do privacy laws affect the location decisions of internet firms? Evidence for privacy havens. European Journal of Law and Economics, 42(2), 1–30.

    Google Scholar 

  59. Rockoff, H. (1992). Price controls. Accessed 10/10/2016.

  60. Romanosky, S., & Acquisti, A. (2009). Privacy costs and personal data protection: Economic and legal perspectives. Berkeley Technology Law Journal, 24(3), 1061–1101.

    Google Scholar 

  61. Rosenberg, E. (2016). The business of google. Accessed 10/25/2016.

  62. Rosoff, M. (2016). Facebook is killing it in the us. Accessed 10/25/2016.

  63. Scott, M. (2015). Europe approves tough new data protection rules. Accessed 9/15/2016.

  64. Silberman, J. I., & Durden, G. C. (1976). Determining legislative preferences on the minimum wage: An economic approach. The Journal of Political Economy, 84(2), 317–329.

    Article  Google Scholar 

  65. Sobel, R. S. (1999). Theory and evidence on the political economy of the minimum wage. Journal of Political Economy, 107(4), 761–785.

    Article  Google Scholar 

  66. Solove, D. J. (2004). The digital person: Technology and privacy in the information age. New York: NYU Press.

    Google Scholar 

  67. Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–564.

    Article  Google Scholar 

  68. Stigler, G. J. (1980). An introduction to privacy in economics and politics. The Journal of Legal Studies, 9(4), 623–644.

    Article  Google Scholar 

  69. Swire, P. (1997). Markets, self-regulation, and government enforcement in the protection of personal information, in privacy and self-regulation in the information age by the U.S. department of commerce. Available at SSRN.

  70. Taylor, C. R. (2004). Consumer privacy and the market for customer information. RAND Journal of Economics, 35(4), 631–650.

    Article  Google Scholar 

  71. Thomson, J. J. (1975). The right to privacy. Philosophy and Public Affairs, 4(4), 295–314.

    Google Scholar 

  72. Tsai, J. Y., Egelman, S., Cranor, L., & Acquisti, A. (2011). The effect of online privacy information on purchasing behavior: An experimental study. Information Systems Research, 22(2), 254–268.

    Article  Google Scholar 

  73. Tucker, C. (2016). Privacy and the internet. In S. Anderson, J. Waldfogel, & D. Stromberg (Eds.), Handbook of Media Economics. Amsterdam: Elsevier.

    Google Scholar 

  74. Turow, J., King, J., Hoofnagle, C.J., Bleakley, A., Hennessy, M. (2009). Americans reject tailored advertising and three activities that enable it. Available at SSRN 1478214.

  75. Varian, H.R. (1996). Economic aspects of personal privacy. In: Privacy and Self-regulation in the Information Age. National Telecommunications and Information Administration Report.

  76. Wauters, R. (2014). Analysis: An appraisal of the burgeoning european ‘app economy,’ and its growing pains. Accessed 10/24/2016.

  77. Weyl, E.G. (2009). The price theory of two-sided markets. Available at SSRN 1324317.

  78. Whittington, J., Hoofnagle, C.J. (2012). Unpacking privacy’s price. North Carolina Law Review, 90(5), 1327.

    Google Scholar 

  79. Yan, J., Liu, N., Wang, G., Zhang, W., Jiang, Y., Chen, Z. (2009). How much can behavioral targeting help online advertising? In Proceedings of the 18th International Conference on World Wide Web, ACM, pp 261–270.

Download references


I wish to thank Chris Coyne, Peter Leeson, Paola Suarez, David Lucas, Nicholas Pusateri, and two anonymous referees for their helpful comments on this paper. Any remaining errors are my own.

Author information



Corresponding author

Correspondence to Caleb S. Fuller.

Additional information

I wish to thank the Mercatus Center for their summer 2016 financial support which enabled me to begin this project.

Rights and permissions

Reprints and Permissions

About this article

Verify currency and authenticity via CrossMark

Cite this article

Fuller, C.S. Privacy law as price control. Eur J Law Econ 45, 225–250 (2018).

Download citation


  • Digital privacy
  • Price control
  • Regulation
  • EU privacy directive

JEL classification

  • K39
  • L51
  • D04