How GDPR Changed European Companies’ Tech Stacks
As companies adapt their IT infrastructure to deal with new privacy regulations, they are coming up against a tradeoff between flexibility and efficiency. Highly integrated technologies facilitate the exchange and use of customer data. The problem is that these very interdependencies are an obstacle on the path toward compliance. Their efficiency has become a liability. That raises an interesting paradox. Can companies achieve competitive advantage by deploying less integrated technologies? To explore this, the authors of this article conducted a large-scale empirical study of 400 e-commerce firms to understand the implications of the tension between efficiency and flexibility on firm performance in response to GDPR. They found that firms that had built their websites for efficiency, electing tightly integrated services from closely linked suppliers, suffered disproportionately when GDPR came into force. In contrast, companies that deployed new combinations of technologies not extensively used before performed much better.
Europe has led the world in protecting consumers’ privacy. E-commerce companies catering to European customers had to comply with the European General Data Protection Regulation (GDPR) starting in May of 2018. Now, many states in the U.S. are adopting similar legislation. California’s Privacy Rights Act and Virginia’s Consumer Data Protection Act went into effect on January 1, 2023, while the Colorado and Connecticut Privacy Acts will become operative on July 1, 2023.
But as companies adapt their IT infrastructure to deal with new privacy regulations, they are coming up against a tradeoff between flexibility and efficiency. Highly integrated technologies facilitate the exchange and use of customer data. For example, e-commerce firms may rely on Google Analytics to track their customers’ behavior, and use Mailchimp for email marketing, which integrates easily with Google Analytics to analyze conversion rates of email marketing campaigns.
E-commerce companies have relied heavily on these highly interdependent technologies to make sure their websites ran efficiently. The problem is that these very interdependencies are an obstacle on the path toward compliance. Their efficiency has become a liability. That raises an interesting paradox. Can companies achieve competitive advantage by deploying less integrated technologies?
To explore this, we conducted a large-scale empirical study of 400 e-commerce firms to understand the implications of the tension between efficiency and flexibility on firm performance in response to GDPR.
When building a digital service like an e-commerce website, you can choose connected components, often from a small group of suppliers, that are commonly used together. This might make you more efficient in harnessing customer data. But you now have many strong interdependencies, and data sharing agreements with third parties, to consider when working towards compliance.
Unfortunately, tech firms that provide the software often struggle to ensure their own compliance and focus on optimizing their own performance during this transition, possibly at the expense of their users’ performance. For example, an EU-based firm that used YouTube and WordPress may have adopted Google Analytics to track its customers’ activity. The three components are interdependent, so that the firm faced more complex and costly adaptation to GDPR. Even though WordPress provides support on how to integrate Google Analytics, the firm would need to discover what GDPR meant for its WordPress website collecting data with Google Analytics.
