Incomplete Contracts and Future Data Usage

Abstract

Most major jurisdictions require websites to provide customers with privacy policies. While privacy policies' most important function is to provide consumers with a description of online service providers' current privacy practices, we argue that these policies also serve a second, often-overlooked function: They allocate among online services and consumers the power to decide whether a service can modify its privacy practices and use consumer data in novel ways. We furthermore argue that a central feature of the E.U.'s General Data Protection Regulation (GDPR), one of the most comprehensive and far-reaching privacy regulatory regimes, is to restrict privacy policies that allocate broad rights for future data usage to service providers. We provide a theoretical explanation for this type of regulatory intervention by adapting standard models of incomplete contracts to privacy policies. We then use the model to explain how U.S. firms reacted to the GDPR. We show that U.S. websites with E.U. exposure are more likely to change their U.S. privacy policies to have stringent and more lenient modification rules. Among websites that do not have E.U. exposure, we see the opposite trend. These results suggest that websites sought to obtain residual rights over data usage after learning of the impact of the GDPR's stricter requirements.