TESTIMONY SENATE COMMITTEE ON THE JUDICIARY HEARING ON UNDERSTANDING THE DIGITAL ADVERTISING ECOSYSTEM AND THE IMPACT OF DATA PRIVACY AND COMPETITION AVI GOLDFARB MAY 22 2019 Executive Summary This committee hearing is focused on the digital advertising ecosystem and the impact of data privacy and competition policy My testimony will focus on the interaction between privacy competition and innovation It will emphasize four points • There are often trade-offs between privacy regulation and innovation Data is a key input into innovation especially for dynamic sectors in the economy However privacy regulation restricts the use of data and may reduce the dynamism of these sectors • There are often trade-offs between privacy regulation and competition Large established companies have the resources to comply with regulation In addition they already have access to the data needed to improve their products This means that regulation can disadvantage startups and smaller companies • Consumers value privacy A growing body of research indicates that consumers value privacy in a variety of contexts Therefore costs related to reduced innovation and competition should be weighed against real benefits • It is possible to mitigate many of the negative consequences of privacy regulations on both competition and innovation For example data portability can help startups and smaller firms innovate and compete and regulatory consistency can reduce the resources needed to ensure compliance 1 Chairman Graham Ranking Member Feinstein and Members of the Committee I am honored to appear before you today to have a discussion on “Understanding the Digital Advertising Ecosystem and the Impact of Data Privacy and Competition Policy ” My name is Avi Goldfarb and I am both Ellison Professor of Marketing and the Rotman Chair in Artificial Intelligence and Healthcare at the University of Toronto 1 Privacy is Not Free Technology reduces the cost of collecting storing and analyzing data This has enabled substantial innovation in many sectors of the economy including healthcare retail financial services and digital marketing Subsequently the increased ability to analyze large quantities of data has contributed to the recent advances in artificial intelligence At the same time the increased use of data has also led to privacy concerns by individuals around the world Low costs mean that every American’s data is sufficiently valuable to be worth collecting This has induced calls by consumers advocates and politicians for privacy regulations that restrict companies from collecting analyzing and exchanging data 1 1 Privacy and Innovation If data cannot be collected then it cannot harm the privacy of the individual At the same time companies collect data for a reason It helps them build better products for their customers whether end consumers or advertisers While it is possible that better privacy protections can generate consumer trust and lead to more useful and reliable data the evidence so far in the U S and Europe indicates a trade-off between privacy and the use of data MIT professor Catherine Tucker and I found that early European privacy regulation the European Union’s e-Privacy Directive EC 2002 58 was associated with a 65% decrease in the effectiveness of online advertising 1 In other words the regulation appears to have improved privacy protection as advertisers likely used less data to target ads As a consequence it is probable that the regulation hurt the European advertising-supported software industry—an industry that has been particularly innovative in the U S and China over the past decade A number of studies 1 Goldfarb and Tucker 2011 Privacy Regulation and Online Advertising Management Science 57 1 57-71 2 have found similar effects for privacy regulations in advertising healthcare and financial services 2 1 2 Privacy and Competition Privacy regulation has the potential to affect new and small companies the most Large established companies have the resources to comply with regulation They can afford the lawyers and engineers necessary to be compliant in ways that smaller companies and startups cannot In addition large established companies already have access to both the data needed to improve their products and a guaranteed source of new data provided by their customers The largest technology companies offer many different types of products and can pool data from those products to innovate and better-serve their customers 3 In contrast startups and smaller companies—whether in the technology industry or not—disproportionately benefit from accessing the data generated by others For example several small companies might be able to pool data together in order to have a similar scope of data to their larger competitors Therefore regulations that restrict the flow of data across companies place a bigger burden on small companies than large companies Of course addressing the data advantage of larger companies by restricting data flows within the large companies will constrain the ability of those companies to innovate Early evidence of the consequences of Europe’s GDPR does suggest that the restrictions on data flows restrictions in the GDPR led to a short-term reduction in the financing of startups 4 2 Goldfarb and Tucker 2012 Privacy and Innovation Innovation Policy and the Economy 12 1 65-90 Lambrecht 2017 EPrivacy Provisions and Venture Capital Investments by the EU London Business School Miller and Tucker 2011 Can Health Care Information Technology Save Babies Journal of Political Economy 119 2 289-324 Kim and Wagman 2015 Screening Incentives and Privacy in Financial Markets A Theoretical and Empirical Analysis The RAND Journal of Economics 46 1 1216 Miller and Tucker 2018 Privacy Protection Personalized Medicine and Genetic Testing Management Science 64 10 4648-4668 3 Campbell Goldfarb and Tucker 2015 Privacy Regulation and Market Structure Journal of Economics and Management Strategy 24 1 47-73 4 Jia Jin and Wagman 2018 The short-run effects of GDPR on technology venture investments Working paper University of Maryland 3 2 Consumers Care about Privacy The above discussion suggests that privacy is not free Nevertheless it is valuable A growing body of evidence suggests that Americans care deeply about privacy This is evident from consumer surveys in which consumers state that privacy is important as well as evidence from the actions of consumers who seek out privacy 5 For example consumers react negatively to overly intrusive ads they increasingly use ad blocking software and they have become less likely to answer survey questions 6 Some regulations can provide substantial value in terms of increased consumer privacy while others will not For instance privacy is particularly important when data could cause negative long-term harm both for the person providing the data and for others Genetic information about a person’s likelihood to suffer from a disease is a good example Such information could affect future employment and insurance prospects as well as that person’s parents siblings and children for decades 7 Even online information about searches for genetically inheritable diseases can cause substantial long-term harm In contrast information that I searched for a Harry Potter book is unlikely to have long-term consequences beyond seeing a large number of ads for Harry Potter merchandise for a few weeks Regulation that focuses on a fair distribution of the profits that companies earn from consumer data rather than on direct or indirect harm to consumers from that data is likely to provide relatively small economic benefits Recent research estimates that each American consumer that opts out of targeted advertising costs advertising platforms $8 58 8 Aggregated across millions of consumers this suggests real value to companies from targeted advertising At the same time for each individual consumer being paid for providing data is unlikely to make much difference to their overall income 5 For a review see Acquisti Taylor and Wagman 2016 The Economics of Privacy Journal of Economic Literature 54 2 442492 6 Bleier and Eisenbeiss 2015 The Importance of Trust for Personalized Online Advertising Journal of Retailing 91 3 390409 Goldfarb and Tucker 2011 Online Display Advertising Targeting and Obtrusiveness Marketing Science 30 3 389-564 Goldfarb and Tucker 2012 Shifts in Privacy Concerns AER Economic Review 102 3 349-353 Shiller Waldfogel and Ryan 2018 The effect of ad blocking on website traffic and quality The RAND Journal of Economics 49 1 43-63 7 Miller and Tucker 2017 Frontiers of Health Policy Digital Data and Personalized Medicine Innovation Policy and the Economy 17 1 49-75 8 Johnson Shriver and Du 2018 Consumer privacy choice in online advertising Who opts out and at what cost to industry Working paper Boston University 4 3 Regulatory Costs can be Mitigated The above discussion points to an important policy trade-off Privacy is valuable but so are innovation and competition It is important to view any new privacy regulations through the lens of their impact on innovation and competition in the technology industry One way to reduce the chances of privacy regulation hurting innovative small firms is to ensure an efficient form of data portability If privacy regulation restricts the pooling of data across firms then it is difficult for startups to compete Giving consumers the ability to take data from one platform and provide it to a startup will help mitigate the negative effects Data portability does this by providing a path through which smaller companies could access the variety of consumer data needed for many types of innovation in this industry In addition regulatory consistency is important Regulatory consistency does not mean that all places need to have the same level of privacy protection Instead by consistency I mean that a company that is compliant in the strictest regime would also be compliant in other jurisdictions That is to say if regulation is different across jurisdictions and changes frequently over time only the best-resourced companies will be able to comply Regulatory consistency both within the U S and internationally makes it easier for startups to grow Furthermore large and small companies can be confident that new products will not be banned 4 Conclusion Privacy is not free but it is valuable The most effective privacy regulation will protect consumer privacy in the areas at most risk while mitigating any negative impact on innovation and competition Thank you for the opportunity to discuss this research and I look forward to answering your questions 5