Scholarship@WashULaw

Document Type

Article

Language

English (en)

Publication Date

2023

Publication Title

Columbia Law School, Law and Economics Research Paper Series

Abstract

Most major jurisdictions require websites to provide customers with privacy policies. For consumers, a privacy policy's most important function is to provide them with a description of the online service provider's current privacy practices. We argue that these policies also serve a second, often-overlooked function: they allocate residual data usage rights to online services or consumers, including the power to decide whether a service can modify its privacy practices and use consumer data in novel ways. We further argue that a central feature of the E.U.'s General Data Protection Regulation (GDPR), one of the most comprehensive and far-reaching privacy regulatory regimes, is to restrict privacy policies from allocating broad rights for future data usage to service providers. We offer a theoretical explanation for this type of regulatory intervention by adapting standard models of incomplete contracts to privacy policies. We then use the model to consider how U.S. firms reacted to the GDPR. We show that U.S. websites with E.U. exposure were more likely to change their U.S. privacy policies to drop any mention of a policy modification procedure. Among websites that do not have E.U. exposure, we see the opposite trend and discuss how to understand these changes in the context of an incomplete contracts model.

Keywords

Privacy, Incomplete, Contracts, GDPR, Policies, Behavioral, Contract Theory

Publication Citation

Jens Frankenreiter, Talia B. Gillis & Dan Svirsky, Incomplete Contracts and Future Data Usage, Columbia Law School, Law & Economics Research Paper Series (2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4350362

Download

Share

COinS