By regulating how firms collect, store, and use data, privacy laws may change the role of data in production and alter firm demand for information technology inputs. We study how firms respond to privacy laws in the context of the EU's General Data Protection Regulation (GDPR) by using seven...

Thanks to big data, artificial intelligence (AI) has spurred exciting innovations. In the meantime, AI and big data are reshaping the risk in consumer privacy and data security. In this essay, I first define the nature of the problem and then present a few facts about the ongoing risk. The bulk...

This paper reviews the economic literature on the European Union's General Data Protection Regulation (GDPR). I highlight key challenges for studying the regulation including the difficulty of finding a suitable control group, variable firm compliance and regulatory enforcement, as well as the...

Many platforms deploy data collected from users for a multitude of purposes. While some are beneficial to users, others are costly to their privacy. The presence of these privacy costs means that platforms may need to provide guarantees about how and to what extent user data will be harvested...

We construct novel text-based measures of firm-level cyber risk exposure based on quarterly earnings calls of 12,000+ firms from 85 countries over 20+ years. We categorize each cyber-related discussion into topics that capture sentiment, monetary loss, country names, etc. We document new facts...

While the advent of cryptocurrencies and digital assets holds promise for improving and disrupting financial systems by offering cheap, quick, and secure transfer of value, it also opens up new payment channels for cybercrimes. A prerequisite to solving a problem is understanding the nature of...

How prevalent are severe software vulnerabilities, how fast do software users respond to the availability of secure versions, and what determines the variance in the installation distribution? Using the largest dataset ever assembled on user updates, tracking server software updates by over...

Data is nonrival: a person's location history, medical records, and driving data can be used by any number of firms simultaneously. Nonrivalry leads to increasing returns and implies an important role for market structure and property rights. Who should own data? What restrictions should apply...