By regulating how firms collect, store, and use data, privacy laws may change the role of data in production and alter firm demand for information technology inputs. We study how firms respond to privacy laws in the context of the EU's General Data Protection Regulation (GDPR) by using seven...

Thanks to big data, artificial intelligence (AI) has spurred exciting innovations. In the meantime, AI and big data are reshaping the risk in consumer privacy and data security. In this essay, I first define the nature of the problem and then present a few facts about the ongoing risk. The bulk...

This paper reviews the economic literature on the European Union's General Data Protection Regulation (GDPR). I highlight key challenges for studying the regulation including the difficulty of finding a suitable control group, variable firm compliance and regulatory enforcement, as well as the...

Many platforms deploy data collected from users for a multitude of purposes. While some are beneficial to users, others are costly to their privacy. The presence of these privacy costs means that platforms may need to provide guarantees about how and to what extent user data will be harvested...

We construct novel text-based measures of firm-level cyber risk exposure based on quarterly earnings calls of 12,000+ firms from 85 countries over 20+ years. We categorize each cyber-related discussion into topics that capture sentiment, monetary loss, country names, etc. We document new facts...

Data is nonrival: a person's location history, medical records, and driving data can be used by any number of firms simultaneously. Nonrivalry leads to increasing returns and implies an important role for market structure and property rights. Who should own data? What restrictions should apply...

When is record-keeping better arranged through a blockchain than through a traditional centralized intermediary? The ideal qualities of any record-keeping system are (i) correctness, (ii) decentralization, and (iii) cost efficiency. We point out a blockchain trilemma: no ledger can satisfy all...

We develop a novel firm-level measure of cybersecurity risk using textual analysis of cybersecurity-risk disclosures in corporate filings. The measure successfully identifies firms extensively discussing cybersecurity risk in their 10-K, displays intuitive relations with quantitative measures of...

In this paper we study how the existence of a functioning market for technology differentially conditions the entry strategy and survival of different types of entrants, and the role of scale, marketing ability and technical assets. Markets for technology facilitate entry of firms that lack...

The amount of computational power devoted to anonymous, decentralized blockchains such as Bitcoin's must simultaneously satisfy two conditions in equilibrium: (1) a zero-profit condition among miners, who engage in a rent-seeking competition for the prize associated with adding the next block to...