The Market for Data Privacy

We scrape a comprehensive set of US firms' privacy policies, and study them alongside firms' web data extraction behaviour. We find considerable and systematic variation in privacy policies along multiple dimensions including ease of access, length, readability, and clarity, both within and between industries. Surprisingly, firms' data extraction is strongly and positively related to the length and complexity of their privacy policies. Firms with intermediate levels of technical sophistication have longer, more complex policies. A simple signalling model of firms engaging in data extraction in an economy with both myopic and sophisticated consumers helps to rationalize these findings.