The Impact of Privacy Regulation on Web Traffic: Evidence From the GDPR

We use traffic data from around 5,000 web domains in Europe and United States to investigate the effect of the European Unions General Data Protection Regulation (GDPR) on website visits and user engagement. We document an overall traffic reduction of approximately 15% in the long-run and find a measurable reduction in engagement with websites. Traffic from both paid and unpaid channels dropped significantly. We observe an inverted U-shaped relationship between website size and change in visits due to privacy regulation: the smallest and largest websites lost visitors, while medium-sized ones were less affected. Enforcement matters as well: The effects were amplified considerably in the long-run, following the first significant fine issued eight months after the entry into force of the GDPR. Exploring potential mechanisms, both a reduction in advertising effectiveness and a higher user awareness of privacy issues can explain our results.