Data Protection, Cookie Consent, and Prices

A legislative process is currently ongoing in the European Union to supplement the 2018 General Data Protection Regulation regarding ePrivacy regulation. The supplement is intended to complete the European data protection policy in significant areas. One addition would be for service providers on the Internet, who currently obtain the consent of their users via an opt-out provision, to always provide a paid alternative without disclosing data. This procedure is essentially aimed at overcoming “cookie consent fatigue”, which can be observed in many cases. A simple economic exchange model shows that users, as data subjects, are basically faced with the choice of paying a monetary price for a service that will also preserve their privacy or using Internet services “for free” while negating data privacy preferences. The individual demand for data privacy coincides with the socially optimal demand only if there is effective competition in the markets for data and Internet services and if users are sufficiently informed. In an online laboratory experiment with students of the Leuphana University of Lueneburg, a between-subjects design was applied in which the control group only had the option to either “pay” for the use of the artificial intelligence DeepL via cookies by surrendering data or to abstain from the service altogether, with the two treatment groups additionally given the option to use DeepL in exchange for a monetary fee so that privacy was not violated. To be tested was whether the “monetary price for privacy” option better reflected users’ privacy preferences than the current cookie opt-out solution. The results show that it was much less common for DeepL to be remunerated with the disclosure of data and less common for DeepL to be waived entirely.