Reciprocal interplay between personal data protection under the GDPR and market concentration in online platform competition

The General Data Protection Regulation (GDPR), as a global benchmark for data protection, establishes a comprehensive framework within the EU to protect personal data while ensuring its free movement. This study clarifies the relationship between personal data and online platforms, examining how personal data protection under the GDPR shapes market dynamics. Drawing on the definition in the GDPR, the study refines the concept of personal data by introducing “distance between the data and the data subject” to better assess identifiability and relevance. The concept of online platforms is shifting away from reliance on organisational structure, areas of application, or technical specifics, instead focusing on functional and purposive characteristics. Online platforms derive significant economic value from collecting, processing, and analysing personal data, making personal data a core asset for market dominance. As a principles-based regulatory framework, the GDPR imposes stricter compliance requirements, thereby raising both fixed and variable costs for online platforms and influencing the scale of personal data processing. From a social production perspective, the GDPR compliance may reduce the overall scale of personal data processed in the market due to increased costs and stricter regulations. The GDPR’s consent framework empowers individuals to control their data and make informed decisions about data disclosure, promoting transparency and trust. This may encourage greater disclosure, thereby potentially increasing the total volume of data shared in the market. From a market perspective, the GDPR also reshapes data collection and competition. In an unregulated market, companies dominate personal data control, leading to potential over-collection and market concentration. The consent framework grants individuals greater control over data disclosures, resulting in a more balanced data scale that reflects privacy preferences. Under the GDPR, stricter provisions generally reduce the scale of personal data collected by both large and small companies, forcing them to minimise risks and comply with higher standards. The ultimate impact of the personal data protection framework depends on various factors, including compliance costs, technology, and the types of service. An empirical study examines the GDPR’s impact on a core downstream market built on personal data - the social media market. The results show that the GDPR reform may have an ex-ante effect caused by the legislative process with voting and publication drafts, as evidenced by a downward trend from 2015. After 2020, the negative impact of the GDPR on EU social media market concentration gradually diminishes. Within the EU, the generalised DID estimators show that the GDPR significantly reduces market concentration in the social media sector across EU member states, with a more pronounced impact on large companies than on smaller ones. This difference may result from the heterogeneity in market share and technological levels, as the GDPR compliance costs are theoretically correlated with the scale and complexity of the market and the technological advantage of adapting to the new regulatory regime.