The reactions of consumers to corporate breaches of the General Data Protection Regulation (GDPR)[Les réactions des consommateurs face aux infractions des entreprises au Règlement Général sur la Protection des Données (RGPD)]

Although the General Data Protection Regulation (GDPR) is legally mandated, its implementation by companies remains inconsistent. This study aims to: (1) identify and categorize the sources of GDPR violations through a qualitative analysis involving digital marketing professionals; and (2) assess the impact of these violations on customer-brand relationships via an experimental study. We differentiate four sources of violation based on whether they are intentional or not, and active or passive. Findings indicate that unintentional or passive violations, by reducing consumer anger, lead to passive behaviors such as continued loyalty to the company (loyalty) or decreased engagement (neglect). Conversely, intentional and active violations, which amplify anger, encourage consumers to react actively by expressing their dissatisfaction constructively (voice) or destructively (retaliation, exit). Although passive reactions may seem less concerning, they present a challenge for companies, which must be able to identify them in order to mitigate their potentially negative impacts.