IDEAS home Printed from https://ideas.repec.org/h/nbr/nberch/15029.html

Effective Regulation and Firm Compliance: The Case of German Privacy Policies

In: Data Privacy Protection and the Conduct of Applied Research: Methods, Approaches and New Findings

Author

Listed:
  • Jacopo Gambato
  • Bernhard Ganglmair
  • Julia K. Krämer

Abstract

This chapter explores the interaction between the enforcement of and compliance with difficult-to-enforce rules in the context of data regulation. We focus on the effect of the introduction of the GDPR and its transparency principle on the readability of privacy policies for a large sample of German firms. Germany has a system of state-level data protection authorities. These data regulators enforce the same rules but face diverse funding situations, allowing for an ideal setting to study the role of a regulator's capacity in firms' compliance decisions. We find that while, on average, the GDPR lead to less readable policies, firms active in industries that have in the past received more regulatory scrutiny and those active in jurisdictions of better-funded data regulators exhibit a stronger compliance with the GDPR's readability requirement. These results exemplify a more general interaction between regulators' enforcement activity and firms' regulatory compliance.
(This abstract was borrowed from another version of this item.)

Suggested Citation

  • Jacopo Gambato & Bernhard Ganglmair & Julia K. Krämer, 2026. "Effective Regulation and Firm Compliance: The Case of German Privacy Policies," NBER Chapters, in: Data Privacy Protection and the Conduct of Applied Research: Methods, Approaches and New Findings, National Bureau of Economic Research, Inc.
    • Handle: RePEc:nbr:nberch:15029
    as

    Download full text from publisher

    File URL: http://www.nber.org/chapters/c15029.pdf
    Download Restriction: no
    ---><---

    Other versions of this item:

    References listed on IDEAS

    as
    1. Bernhard Ganglmair & Julia Krämer & Jacopo Gambato, 2024. "Regulatory Compliance with Limited Enforceability: Evidence from Privacy Policies," CRC TR 224 Discussion Paper Series crctr224_2024_547v2, University of Bonn and University of Mannheim, Germany, revised Sep 2024.
    2. Stern, J., 2000. "Electricity and telecommunications regulatory institutions in small and developing countries," Utilities Policy, Elsevier, vol. 9(3), pages 131-157, September.
    3. Laffont,Jean-Jacques, 2005. "Regulation and Development," Cambridge Books, Cambridge University Press, number 9780521549486.
    4. repec:cup:cbooks:9780521840187 is not listed on IDEAS
    5. Samuel G. Goldberg & Garrett A. Johnson & Scott K. Shriver, 2024. "Regulating Privacy Online: An Economic Evaluation of the GDPR," American Economic Journal: Economic Policy, American Economic Association, vol. 16(1), pages 325-358, February.
    6. Bocong Yuan & Jiannan Li, 2019. "The Policy Effect of the General Data Protection Regulation (GDPR) on the Digital Public Health Sector in the European Union: An Empirical Investigation," IJERPH, MDPI, vol. 16(6), pages 1-15, March.
    7. Garrett A. Johnson & Scott K. Shriver & Samuel G. Goldberg, 2023. "Privacy and Market Concentration: Intended and Unintended Consequences of the GDPR," Management Science, INFORMS, vol. 69(10), pages 5695-5721, October.
    8. Christian Peukert & Stefan Bechtold & Michail Batikas & Tobias Kretschmer, 2022. "Regulatory Spillovers and Data Governance: Evidence from the GDPR," Marketing Science, INFORMS, vol. 41(4), pages 746-768, July.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Vincent Lefrere & Logan Warberg & Cristobal Cheyre & Veronica Marotta & Alessandro Acquisti, 2026. "Does Privacy Regulation Harm Content Providers? A Longitudinal Analysis of the Impact of the GDPR," Management Science, INFORMS, vol. 72(3), pages 1727-1747, March.
    2. Wang, Zhen, 2026. "Can the establishment of a personal data protection system promote firm value? An exploration of the economics of privacy," Research in International Business and Finance, Elsevier, vol. 82(C).
    3. Chongwoo Choe & Noriaki Matsushima & Shiva Shekhar, 2025. "The Bright Side of the GDPR: Welfare-Improving Privacy Management," Management Science, INFORMS, vol. 71(8), pages 6836-6858, August.
    4. Fasheng Xu & Xiaoyu Wang & Fuqiang Zhang, 2025. "Consumer Privacy in Online Retail Supply Chains," Management Science, INFORMS, vol. 71(10), pages 8371-8389, October.
    5. Paulich, Brianna JeeWon & Cheng, Yichen & Shah, Denish, 2026. "Managing conversions of anonymous online users: a privacy-compliant framework," Journal of Business Research, Elsevier, vol. 202(C).
    6. Jingjing Li & Haiyang Feng & Nan Feng & Nan Yuan, 2026. "Optimal Data Collection Levels for Two-Sided Software Platforms: Considering User Privacy Concerns," Information Systems Frontiers, Springer, vol. 28(1), pages 249-271, February.
    7. Tommaso Bondi & Omid Rafieian & Yunfei (Jesse) Yao, 2026. "Privacy and Polarization: An Inference-Based Framework," Management Science, INFORMS, vol. 72(2), pages 1389-1409, February.
    8. Ke Rong & D. Daniel Sokol & Di Zhou & Feng Zhu, 2026. "Antitrust Platform Regulation and Entrepreneurship: Evidence from China," Management Science, INFORMS, vol. 72(7), pages 6334-6349, July.
    9. Gleb Papyshev & Keith Jin Deng Chan, 2026. "AI regulatory strategies for digital sovereignty: The role of geopolitics and technological disparities," Electronic Markets, Springer;IIM University of St. Gallen, vol. 36(1), pages 1-12, December.
    10. Raveesh Mayya & Siva Viswanathan, 2025. "Delaying Informed Consent: An Empirical Investigation of Mobile Apps’ Upgrade Decisions," Management Science, INFORMS, vol. 71(8), pages 7113-7135, August.
    11. Carl Benedikt Frey & Giorgio Presidente, 2024. "Privacy regulation and firm performance: Estimating the GDPR effect globally," Economic Inquiry, Western Economic Association International, vol. 62(3), pages 1074-1089, July.
    12. Mohamad, Noorihsan, 2014. "Telecommunications reform and efficiency performance: Do good institutions matter?," Telecommunications Policy, Elsevier, vol. 38(1), pages 49-65.
    13. Fabio Motoki & Jedson Pinto, 2025. "Regulating data: Evidence from corporate America," Journal of Business Finance & Accounting, Wiley Blackwell, vol. 52(1), pages 541-568, February.
    14. Antonio Estache & Liam Wren-Lewis, 2008. "Towards a Theory of Regulation for Developing Countries: Following Laffont's Lead," Working Papers ECARES 2008_018, ULB -- Universite Libre de Bruxelles.
    15. Wu, Shansong & Xiao, Wei & Liang, Kai-Rong & Li, Kevin W., 2025. "A co-opetitive game analysis of platform compatibility strategies under data security regulation," Transportation Research Part E: Logistics and Transportation Review, Elsevier, vol. 201(C).
    16. Louis-Daniel Pape & Michelangelo Rossi, 2026. "Is Competition Only One Click Away? The Digital Markets Act’s Impact on Google Maps," Marketing Science, INFORMS, vol. 45(3), pages 596-613, May.
    17. Nils Wernerfelt & Anna Tuchman & Bradley T. Shapiro & Robert Moakler, 2025. "Estimating the Value of Offsite Tracking Data to Advertisers: Evidence from Meta," Marketing Science, INFORMS, vol. 44(2), pages 268-286, March.
    18. Jing Cao & Tracy Xiao Liu & Rong Ma & Ang Sun, 2025. "Antisocial Responses to the “Coal to Gas” Regulation: An Unintended Consequence of a Residential Energy Policy," Management Science, INFORMS, vol. 71(10), pages 8698-8726, October.
    19. Ziru Li & Gunwoong Lee & T. S. Raghu & Zhan (Michael) Shi, 2025. "Impact of the General Data Protection Regulation on the Global Mobile App Market: Digital Trade Implications of Data Protection and Privacy Regulations," Information Systems Research, INFORMS, vol. 36(2), pages 669-689, June.
    20. Chen, Wanyi & Wang, Yiying & Wu, Dongjing & Yin, Xingqiang, 2024. "Can the establishment of a personal data protection system promote corporate innovation?," Research Policy, Elsevier, vol. 53(9).

    More about this item

    JEL classification:

    • D22 - Microeconomics - - Production and Organizations - - - Firm Behavior: Empirical Analysis
    • K20 - Law and Economics - - Regulation and Business Law - - - General
    • L51 - Industrial Organization - - Regulation and Industrial Policy - - - Economics of Regulation

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:nbr:nberch:15029. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: the person in charge (email available below). General contact details of provider: https://edirc.repec.org/data/nberrus.html .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.