Which Privacy Policy Works, Opt-In Requirement or Inference Regulation? A Game-Theoretic Analysis of Privacy Policies in E-Commerce

Abstract

With the rapid development of e-commerce, data-driven models have significantly enhanced service experience. We can obtain the optimal values for the price but have also intensified consumer privacy concerns. Among various privacy protection policies, which are more effective? Is there a governance framework that balances commercial efficiency with privacy safety? To address this, we develop a duopoly game-theory model that analyzes consumer behavior characterized by heterogeneous privacy costs and preferences, aiming to evaluate the impact of differentiated privacy protection policies within digital ecosystems. We analyze whether opt-in requirement or inference regulation is more advantageous for consumer and firm competition. We find that, in a competitive environment, imposing opt-in requirement on one party can yield competitive advantages and profit increases, whereas imposing inference regulation on the other may result in a competitive disadvantage. Such differentiated policies create an asymmetric competitive landscape, effectively avoiding a prisoner’s dilemma and, under certain conditions, increasing both consumer and total surplus. Furthermore, our study reveals significant differences in the impact of these policies on data-driven and usage-driven firms. Based on these findings, we recommend that regulators carefully tailor privacy protection policies according to industry-specific data characteristics, adopting differentiated regulatory strategies when appropriate and providing compensation mechanisms for disadvantaged firms to optimize total welfare.

1. Introduction

As e-commerce rapidly develops, the scope of consumer data collection and utilization by enterprises has significantly expanded, aiming to enhance consumer experience and commercial efficiency through personalized services [1,2]. However, this data-driven business model has triggered widespread consumer concerns regarding privacy, manifesting as increased sensitivity to the collection, utilization, and secondary use of personal information [3,4,5]. Studies indicate that privacy concerns can significantly suppress consumer behavior and exert adverse effects on purchasing decisions, highlighting the potential constraints privacy issues impose on the digital economy [6].

In response to this challenge, privacy protection policies such as the European Union (EU)’s General Data Protection Regulation (GDPR) have been enacted, alongside similar policies introduced by other countries and U.S. states. These privacy frameworks predominantly focus on data control concepts, such as opt-in requirement [7]. Privacy concerns may not necessarily stem from users’ lack of control over certain data types but could originate from corporate inference capabilities derived from broad datasets [8,9]. Such inference abilities potentially intensify privacy concerns, as information may be indirectly disclosed through correlations, even when consumers exercise control over data [7]. Opt-in requirement restricts data collection by firms, whereas inference regulation, which prohibits inference, curbs firm data usage. Simultaneous implementation of these two policies presents a tension: firms are constrained from engaging in deep modeling using existing non-sensitive data, and the prospect of users opting out of purchases results in data attrition, thereby impacting the operational efficiency of e-commerce firms. Therefore, determining which policy better favors consumers and confers competitive advantages to firms remains an urgent research question.

To address this question, this study constructs a duopoly model analyzing the effects of differentiated privacy protection policies in a competitive environment. The model assumes two firms positioned at opposite ends of a consumer preference distribution, offering services for heterogeneous consumers, a scenario that can be extended to online retail product markets. Consumers exhibit heterogeneity across two dimensions: locations in terms of the preferences and privacy costs. Their purchase decisions are based on service fit, price, and privacy cost, with privacy concerns following Westin’s tripartite classification: privacy fundamentalists, pragmatists, and the unconcerned [10]. When consumers choose to share personal data with firms, which constitutes opt-in behavior, they gain additional utility; conversely, opting out involves mechanisms where consumers decline data sharing. Firm A follows opt-in requirement, emphasizing data control and offering standardized services, while Firm B follows inference regulation, which restricts its ability to infer consumer data from databases. Firms’ revenues derive from two sources: service-based sales revenue and data monetization, respectively termed usage-based and data-based revenues. Prior to policy implementation, markets only offered personalized services. Post-implementation, Firm A must provide standardized options, and Firm B faces limitations on inference technology. Firms maximize profits through strategic service pricing and inference accuracy investments, while consumers decide on service purchase and data sharing. A comparative analysis of equilibrium states before and after policy enactment assesses the effects of differentiated privacy protection policies.

Based on this duopoly model, this study aims to address three research questions: (1) How do opt-in requirement and inference regulation influence firms’ equilibrium pricing, market shares, and profit distribution within a competitive setting? (2) How do systemic parameters—such as the proportion of fundamentalists, consumers’ preference intensity parameter, and inference investment cost intensity parameter—affect equilibrium results? (3) How do differentiated privacy policies modify consumer surplus, and to what extent can such policies balance privacy protection with commercial efficiency?

This study hypothesizes that prior to policy implementation, the market does not offer standardized services, and consumers are required to share personal information with firms when purchasing any service. This is attributable to lax enforcement and nominal penalties associated with pre-policy conditions, rendering firms’ commitments to “no data collection” untenable. It was only upon the introduction of privacy protection policies that consumers genuinely acquired an opt-out purchase. We also assume that firms fully comply with regulatory requirements, aligning with the foundational assumptions in Choe et al. (2025) [11]. The stipulated penalty levels are sufficiently stringent to ensure corporate compliance. Furthermore, even when firms exhibit imperfect adherence to privacy regulations in practice, the primary conclusions of this study remain valid, an assumption we deem reasonable. In brief, a significant change brought by inference regulation is that Firm B’s revenue streams diminish, potentially leading to alterations in pricing strategies. The opt-in requirement restricts data collection by firms, enabling fundamentalists to purchase standardized services.

Unlike prior research analyzing the impact of single privacy protection policy on firms, this study’s contribution lies in analyzing differentiated privacy protection policies applied to two competing firms, designed to investigate the relative effectiveness of opt-in requirement and inference regulation. This approach aims to inform governmental policy formulation as well as corporate privacy strategy development, particularly in balancing data collection intensity against usage restrictions. To our knowledge, this is the first study to incorporate multiple data externalities into a duopoly model within a competitive environment, quantifying the positive and negative externalities of data scale on the revenue and consumer utility of competing firms, thereby significantly enhancing the model’s capacity to reflect market complexity. This facilitates a clearer understanding of how externalities influence the effectiveness of privacy protection policies, firm profits, and consumer surplus. Building on prior research, our hypothesis posits that consumers differ along two dimensions: locations in terms of the preferences and privacy costs. This assumption reflects the heterogeneity observed in consumer behavior within real markets, especially under competitive dynamics, where preference heterogeneity plays a crucial regulatory role [12]. Studies by Cai et al. (2019) and T. Lin (2022) suggest considerable heterogeneity in individual privacy preferences, motivating the incorporation of more detailed heterogeneity structures to improve model accuracy in capturing individual behaviors and enhance the robustness of the conclusions [13,14]. This contribution advances the discourse on digital ecosystems by offering a framework to assess how differentiated regulatory policies can balance privacy security with commercial vitality, ultimately informing strategies that aim to benefit both service providers and consumers.

Our study offers policy makers a strategic framework for implementing differentiated policies, advocating targeted oversight based on industry characteristics, imposing differentiated compliance obligations across firms within the same market, and providing appropriate compensation to disadvantaged competitors to balance privacy protection with economic efficiency. A critical finding is that differentiated privacy protection policies impose constraints on data-driven firms, whose revenue is highly contingent on user data advertising, such as affiliate marketing platforms and price comparison search engines. Conversely, usage-driven firms, whose models depend on actual usage volume, like ride-hailing platforms, benefit from these policies. For firms, the findings suggest that privacy compliance should not be regarded solely as a cost but as a strategic variable capable of reshaping competitive dynamics. Proactive transformation of privacy requirements into differentiated competitive advantages is recommended [15].

The remaining sections of this paper are structured as follows: Section 2 reviews relevant literature. Section 3 introduces the baseline model. Section 4 analyzes the equilibrium state of the baseline model. Section 5 examines the impact of privacy policies. Section 6 discusses several extensions and variants of the baseline model. Finally, Section 7 summarizes the conclusions, highlights limitations of the study, and proposes managerial implications along with future research directions. Appendix A provides detailed derivations and analytical processes related to this paper.

2. Literature Review

Our study mainly relates to three streams of the existing literature: the impact of privacy concerns on consumer behavior, privacy protection and policy interventions, and data externalities in policy intervention. Next, we briefly review the literature in each stream and show how our study relates to it.

2.1. The Impact of Privacy Concerns on Consumer Behavior

Privacy concerns serve as a core indicator of consumers’ belief in the security of their personal information [16]. These concerns encompass multiple dimensions, including information collection, usage permissions, and secondary data utilization. Some studies have revealed the privacy paradox, highlighting the contradiction whereby consumers claim to value privacy yet frequently disclose information for marginal gains [1,17,18]. Building on this, Sabrina Karwatzki et al. (2017) grounded in information boundary theory, empirically demonstrated that perceived privacy valuation directly suppresses consumers’ willingness to disclose information—a phenomenon particularly pronounced in personalized service contexts [4]. Alkis and Kose (2022) further established a negative correlation between the likelihood of e-commerce participation and the attention paid to online activity records, thereby confirming that privacy concerns significantly inhibit e-commerce engagement [19]. Consumer privacy concerns are modulated by various factors, including personality traits and demographic characteristics [20,21]. Chung et al. (2024) indicated that consumers’ privacy concerns vary across different types of information, exhibiting heterogeneity in sensitivity [22]. Huang and Qian (2025) unveiled heterogeneity in privacy preferences across diverse consumer segments [23].

Collectively, these studies underscore the necessity of accounting for multifaceted consumer heterogeneity when examining the influence of privacy concerns on behavior [12,24,25,26]. Building upon this foundation, our study introduces a two-dimensional heterogeneity framework considering both consumer location in terms of the preferences and privacy costs. Analogous to Lee et al. (2011), who characterized consumer heterogeneity, we incorporate additional considerations of privacy concern loss ($y$) based on consumer classification and consumer location in terms of the preferences to systematically analyze how privacy policies influence consumer behavior within competitive environments [26]. Following the classification suggested by Westin et al. (1995), we segment consumers into three groups based on the levels of privacy cost: the unconcerned, fundamentalists, and pragmatists [10]. In e-commerce, fundamentalists decline data-sharing with firms when acquiring products and services, pragmatists trade data for perceived value, and the unconcerned widely share data for convenience. This consumer segmentation remains applicable within the contemporary context of data-driven models [27,28]. Qian and Jain (2024) found that recommendation systems may exacerbate consumers’ privacy concerns, especially when recommended content does not align with user preferences [29]. Concurrently, Li et al. (2019) constructed a tripartite game model within an IoT context, indicating that users, perceiving privacy leakage through social interactions, adjust their engagement decisions accordingly; heterogeneity in privacy preferences leads to distinct response patterns [13]. These findings highlight significant interaction effects between privacy concerns and preference heterogeneity, thereby substantiating the necessity and value of our dual-heterogeneity analytical framework.

2.2. Privacy Protection and Policy Interventions

In recent years, the economic repercussions of privacy protection policies have emerged as a prominent focus within academic discourse. Existing research has examined the efficacy and limitations of various policy tools across multiple dimensions, providing critical insights for the design of regulatory policies. Fainmesser et al. (2023) highlight that the Federal Trade Commission’s (FTC) emphasis on minimal data protection requirements may inadvertently produce adverse effects, diminishing consumer surplus and overall welfare—effects that are particularly pronounced among firms operating under mixed income models [30]. This finding underscores the constraints inherent in singular policy instruments and lays the groundwork for studying policy combinations. Concurrently, Galperti et al. (2024) demonstrate through theoretical modeling that the value of data logging hinges on intermediary information disclosure strategies, suggesting that policy interventions must carefully balance data utilization efficiency against privacy protection [31].

In terms of evaluating policy impacts, scholars have identified complex interactions among different regulatory tools. Goldfarb and Tucker (2019) confirm that the General Data Protection Regulation (GDPR) has reduced the effectiveness of online advertising [32]. S. G. Goldberg et al. (2023) further report that GDPR enforcement has led to a 12% decline in both European users’ website page views and site revenues [33]. Choe et al. (2025) emphasize that the welfare effects of GDPR are contingent upon firms’ revenue models: data-dependent enterprises tend to suffer, whereas service-driven firms may benefit [11]. Empirical analysis by Goldberg et al. (2024) indicates that privacy regulations can induce profit redistribution, favoring firms offering standardized services while adversely impacting data-dependent businesses [34]. These findings highlight the necessity of context-specific market structure considerations in policy assessment [33,35]. Moreover, contradictions within policy design warrant attention. Miklós-Thal et al. (2024) critique that current privacy policies predominantly focus on data control mechanisms, while neglecting the significance of inference regulation [7]. Although effective privacy policies can mitigate negative outcomes related to privacy intrusion, other studies reveal potential detrimental effects: privacy regulations may exacerbate perceived risks, leading consumers to infer negative consequences from data disclosures [36]. Additional research has explored policies such as personalized disclosures, privacy guarantees, data retention limits, quality discrimination, and breach notification requirements [14,37,38,39,40,41], and their practical effectiveness exhibits variability.

With the proliferation of personalized marketing initiatives, the adoption of specific privacy protection policies continues to rise. However, the impact of privacy regulation on societal welfare is highly context-dependent, prompting a need for systematic analysis of the policy implementation environment. To deepen the understanding of privacy protection policy efficacy, this study examines the interactive effects of two extensively implemented policy instruments: the opt-in requirement and the inference regulation. Opt-in requirement mandates that firms furnish an option to forego data purchase without curtailing their data utilization latitude, requiring explicit provision of a data non-sharing choice at the juncture of consumer service selection. Conversely, inference regulation entirely constrains firms’ capacity to infer sensitive data attributes, precluding deductions regarding consumer health status from browsing histories, for instance, without necessitating a data non-sharing option. The former imposes constraints on data acquisition by enterprises, while the latter delimits the modalities of data utilization. We will analyze these policies to elucidate their interaction mechanisms influencing consumer privacy concerns and purchasing behaviors in a competitive environment centered on service offerings.

2.3. Data Externalities in Policy Intervention

Data externalities within the context of policy intervention have emerged as a frontier topic in digital economics, garnering extensive scholarly attention in recent years. Existing literature predominantly examines spillover effects of data sharing from the perspectives of positive and negative externalities. Concerning negative externalities, Fainmesser et al. (2023) highlight how firms can infer correlations within user data—for example, deducing personality traits from floral preferences [30]. Chiou and Tucker (2017a) identify privacy externalities arising from data retention policies in search engines, such as opt-in data being used to infer additional consumer behaviors [38]. Building on this, our study incorporates firms’ inferential data behaviors into a game-theoretic model to analyze the policy effects of inference regulation. Acemoglu et al. (2019b) further demonstrate that data externalities suppress data market prices, leading to excessive data sharing and consequent welfare losses [8]. On the positive externality, J. P. Choi et al. (2019), and Hagiu and Wright (2023) find that data-driven algorithms improve matching efficiency, such as through recommendation systems, although these benefits may incentivize overcollection of data [42,43]. Miklós-Thal et al. (2024) observe that data sharing can induce polarization of user behavior, with some users resorting to digital hermithood by completely withdrawing from sharing activities, while others excessively share, thereby amplifying externality effects [7].

Bergemann et al. (2022) conduct a systemic analysis of social welfare implications of data sharing within a societal data economics framework, primarily focusing on monopolistic market structures [9]. J. P. Choi et al. (2019) identify information externalities stemming from consumers’ voluntary participation, leading to information spillovers [42]. Goldberg et al. (2024) note that GDPR implementation restrictions on data access create asymmetric impacts on firms [34].

However, existing research on the effects of externalities on policy efficacy predominantly centers on single-policy scenarios, lacking systematic exploration of the combined effects of policies. In particular, the interaction mechanisms under duopolistic competition environments remain under-investigated. To our knowledge, this is the first study to incorporate multiple data externalities into a duopoly model within a competitive environment. By developing a theoretical framework that includes firms’ inferential behaviors, we systematically analyze the mechanisms through which data externalities influence policy outcomes. By quantifying how data externalities marginally affect consumer surplus and firm profits, this research not only offers a theoretical macroeconomic basis for policymaking but also extends the existing literature on competitive e-commerce markets.

3. Model

We consider a market with two competing firms, A and B, that provide services, such as ride-hailing platforms or weather apps, at zero marginal cost and charge price. To capture the difference, we assume that consumer preferences are uniformly distributed on the line [0, 1], which reflects the diversity of brand loyalty and taste in reality. Firms are located at the ends of the line, Firm A at $x$ = 0 and Firm B at $x$ = 1, meaning consumers choose between them based on the match between their ideal preference and the firm’s position. In the first period, termed the period without privacy protection, Firm A and Firm B do not provide opt-out purchase to consumers and both firms can infer privacy-sensitive data and other data they need from consumers’ nonsensitive data [8,42]. In the second period, termed the period with two differentiated privacy protection policies, the government implements two types of policies to enhance privacy information security. Firm A can infer data but Firm A should provide consumers with an additional choice of opt-out purchase. Firm B does not provide opt-out purchase but Firm B is not allowed to infer data.

Consumers are heterogeneous along two dimensions: location in terms of the preference ($x$) and privacy cost ($y$). We assume $x$ and $y$ are independent and uniformly distributed on ${[0,1]}^2$. Consumers close to $x$ = 0 prefer Firm A and they will incur a loss of value $tx$ from consuming a service that does not fit perfectly with their preference, where $x$ is the distance between the location of the consumer’s preference and the location of the Firm A on the line and $t$ represents the intensity of the loss of value. Consumers close to $x$ = 1 prefer Firm B and they will incur a loss of value $t$($1-x$) from consuming a service. The setting of this parameter was informed by the research of Lee et al. (2011) to capture the heterogeneity in consumer behavior observed in real markets [26]. Specifically, a higher value of t indicates that consumers possess a greater sensitivity and loyalty to their preferred brands or service types, such that even minor deviations in preference result in substantial utility loss. Such consumers are typically reluctant to readily accept alternative options. Conversely, a lower value of t corresponds to consumers who are less sensitive to brand or service differentiation; even when their chosen service deviates somewhat from their ideal preference, the perceived utility loss is minimal, thereby exhibiting greater flexibility in their purchasing decisions. By introducing this continuous variable, the model is capable of more finely delineating the complex differences among consumers along the preference dimension, consequently enhancing its explanatory power regarding consumer choice behavior within realistic market conditions. Following the classification suggested by Westin et al. (1995), we segment consumers into three groups based on the levels of privacy cost: the unconcerned, fundamentalists, and pragmatists [10]. Let $u$, $v$, and $w$ ($w=1-u-v$) respectively denote the size of the unconcerned, pragmatist, and fundamentalist segments. Notably, these proportions are not fixed but are context-dependent; for instance, disparities in privacy attitudes between Asian and European consumers would yield different numerical values. The notations of this paper are summarized in

Table 1. Notations & Descriptions.

Notations	Descriptions
$x$	The consumer location in terms of the preference
$y$	The privacy cost
$t$	The consumers’ preference intensity parameter
$u$	The proportion of the unconcerned
$v$	The proportion of pragmatists
$w$	The proportion of fundamentalists
$s$	The benefit from opting in
$p_{ki}^{pers}$	The price of personalized service of firm $i$ in the $k$ period
$p_{ki}^{std}$	The price of standardized service of firm $i$ in the $k$ period
$R$	The consumer reservation value
$U_{ki}^{pers}$	The utility of personalized service of firm $i$ in the $k$ period
$U_{ki}^{std}$	The utility of standardized service of firm $i$ in the $k$ period
$D_{ki}^{pers}$	The demand of personalized service of firm $i$ in the $k$ period
$D_{ki}^{std}$	The demand of standardized service of firm $i$ in the $k$ period
$\alpha$	The value of per unit of consumer data
${\sigma }_{ki}$	The inference accuracy of firm $i$ in the $k$ period
$K$	The inference investment cost intensity parameter
${\mathit{\pi }}_{ki}$	The profit of firm $i$ in the $k$ period
CS	The consumer surplus
TS	The total surplus

.

Fundamentalists have a very high level of privacy concerns. They are firmly resistant to sharing their privacy and data with firms. Thus, we assume that fundamentalists exclusively purchase the firm’s standardized services and do not purchase personalized services (see Figure 1). In contrast, the unconcerned individuals are willing to share their privacy information with firms in exchange for additional benefits and choose opt-in purchase. We call this the benefit from opting in, denoted by $s\in$($\mathrm{0,1}$). The additional benefits can be understood as firms using data to make services more in line with consumer preferences, thereby increasing the utility of the service. Personalized services can also significantly reduce consumers’ time and energy in selecting services, achieving additional benefits. The privacy concerns of pragmatists fall between those of fundamentalists and the unconcerned, as they evaluate the utility of services. If the utility derived from personalized services exceeds that of standardized ones, pragmatists are inclined to share their personal information with firms; conversely, they tend to choose opt-out purchase. We assume that the additional utility from personalized services is significant, so both pragmatists and the unconcerned prefer them.

3.1. Before the Privacy Protections

In the first period, Firm A and Firm B exclusively provide personalized services. The personalized service price for firm $i$ during the first period is denoted by $p_{1i}^{pers}$, where $i=$A, B. Let $R$ denote the consumer reservation value for a service that perfectly fits preferences. Therefore, consumers face three possible choices: buying a service from Firm A, buying a service from Firm B and not buying a service.

A consumer of type $(x,y)\in {[0,1]}^2$ who chooses Firm A’s personalized services receives utility:

$$U_{1A}^{pers}=R-p_{1A}^{pers}+s-y-tx.$$

(1)

where $tx$ is the loss of value from consuming a service that does not fit perfectly with preference, and $s-y$ is the opt-in benefits less privacy cost. If a consumer chooses Firm B’s services, then the utility is

$$U_{1B}^{pers}=R-p_{1B}^{pers}+s-y-t(1-x).$$

(2)

Clearly, before the privacy protection, the primary difference between the two firms’ services is the utility loss resulting from user preference deviations. Consumers choose Firm A’s personalized services if $U_{1A}^{pers}>U_{1B}^{pers}$.

Without privacy protection policy restrictions, both firms can utilize database data to infer data they need. The firms’ revenue comes from three sources. First, the firms earn revenue from sales of their services, with $D_{1i}^{pers}$ representing the total personalized service demand of company $i$ during the first period. Second, firms can monetize data derived from personalized services. For example, data can be employed for personalized pricing, utilized to enhance service offerings, operational efficiency, and treated as an asset for trading or the development of new firm ventures [43,44,45]. We assume that this revenue is exogenously given by $\alpha \in (\mathrm{0,1})$ per unit of consumer data, and each unit of consumer data holds equivalent value for both Firm A and Firm B within the same industry. The value of unit consumer data varies significantly across enterprises based on their industry affiliation and business model. For usage-driven companies, such as ride-hailing platforms, whose service value is directly correlated with transaction volume, data is primarily employed to enhance operational efficiency, resulting in a relatively lower marginal value per unit of data. Conversely, for data-driven companies, including affiliate marketing platforms and price comparison search engines, whose core revenue is highly contingent upon precise advertising placements informed by user data, data constitutes a critical input factor for their business model, thus yielding a comparatively higher value per unit of data. This disparity underscores the divergent roles and contributions of data within distinct production functions. In the baseline model, we only focus on the direct effects of data in generating additional benefits for firms. A comprehensive analysis of how data externalities indirectly influence consumer surplus through market interactions will be systematically developed in the model extension section. Third, firms monetize data derived from inference. Let ${\sigma }_{1i}$ denote the inference accuracy of firm $i$, which can be enhanced through investment at cost $K{\sigma }_{1i}^2$, yielding revenue $\alpha {\sigma }_{1i}{D}_{1i}^{pers}-K{\sigma }_{1i}^2$. Analogous to parameter t, we introduce parameter K into the model to quantify firms’ technical efficiency. Parameter K characterizes the heterogeneity in firms’ technical efficiency, reflecting variations in the cost required to achieve identical inference accuracy. Firms with higher technical capabilities can attain objectives at a lower cost, corresponding to a lower K value; conversely, this corresponds to a higher K value.

In the first period, Firm A’s profit is given by

$${\mathit{\pi }}_{1A}=p_{1A}^{pers}{D}_{1A}^{pers}+\alpha D_{1A}^{pers}+\alpha {\sigma }_{1A}{D}_{1A}^{pers}-K{\sigma }_{1A}^2.$$

(3)

Similarly, Firm B’s profit is

$${\mathit{\pi }}_{1B}=p_{1B}^{pers}{D}_{1B}^{pers}+\alpha D_{1B}^{pers}+\alpha {\sigma }_{1B}{D}_{1B}^{pers}-K{\sigma }_{1B}^2.$$

(4)

3.2. After the Privacy Protections

In the second period, the government implements two differentiated privacy protection policies. Policy A, the opt-in requirement, mandates that Firm A must obtain explicit user consent before collecting sensitive data and grants users the “right to be forgotten” for data deletion, exemplified by the EU’s GDPR, which emphasizes data control. Policy B, inference regulation, restricts Firm B’s ability to derive sensitive information from already collected data, as illustrated by the proposed EU AI Act, which prohibits inferring sensitive attributes such as political opinions or religious beliefs through biometric identification systems. Due to the high level of privacy concerns among fundamentalists, we assume that fundamentalists face two possible choices: buying standardized services from Firm A and not buying services. Based on the assumption that the utility derived from personalized services is sufficiently significant, the unconcerned and pragmatists face two distinct choices: buying personalized services from Firm A or from Firm B.

Fundamentalists of type $(x,y)\in {[0,1]}^2$ who choose Firm A’s standardized services receive utility:

$$U_{2A}^{std}=R-p_{2A}^{std}-tx.$$

(5)

The unconcerned and pragmatists of type $(x,y)\in {[0,1]}^2$ who choose Firm A’s personalized service receive utility:

$$U_{2A}^{pers}=R-p_{2A}^{pers}+s-y-tx.$$

(6)

The unconcerned and pragmatists of type $(x,y)\in {[0,1]}^2$ who choose Firm B’s personalized service receive utility:

$$U_{2B}^{pers}=R-p_{2B}^{pers}+s-y-t(1-x).$$

(7)

Under the constraints of the privacy protection policies, Firm A’s revenue comes from three sources: sales of personalized and standardized services, data utilization ($\alpha D_{2A}^{pers}$), and inference-based revenue ($\alpha {\sigma }_{2A}{D}_{2A}^{pers}-K{\sigma }_{2A}^2$). In contrast, Firm B’s revenue is constrained to personalized service sales and data monetization ($\alpha D_{2B}^{pers}$), reflecting the impact of inference regulation.

Firm A’s profit is given by

$${\mathit{\pi }}_{2A}=p_{2A}^{std}{D}_{2A}^{std}+p_{2A}^{pers}{D}_{2A}^{pers}+\alpha D_{2A}^{pers}+\alpha {\sigma }_{2A}{D}_{2A}^{pers}-K{\sigma }_{2A}^2.$$

(8)

Firm B’s profit is

$${\mathit{\pi }}_{2B}=p_{2B}^{pers}{D}_{2B}^{pers}+\alpha D_{2B}^{pers}.$$

(9)

It is evident that following the implementation of differentiated privacy protection policies, Firm B’s revenue streams appear to be singular and constrained, whereas Firm A exhibits a more diversified revenue model, highlighting how privacy protection policies can reshape competitive dynamics in service-based ecosystems.

4. Analysis

4.1. Equilibrium Before the Privacy Protection

During this period, all firms do not offer an opt-out purchase for data sharing and consumers are required to disclose their data concurrently with service purchase. Assuming that personalized services confer significant utility, the unconcerned and pragmatists do not purchase standardized services. Their choices are limited to either acquiring a personalized service from Firm A or from Firm B, contingent upon which option yields greater utility. Due to the heightened privacy concerns among fundamentalists and the absence of standardized services during this period, they abstain from purchasing offerings from either firm.

A consumer of type $(x,y)$ buys Firm A’s service if and only if

$$U_{1A}^{pers}\ge U_{1B}^{pers}\Rightarrow x\le {\displaystyle \frac{1}{2}}+{\displaystyle \frac{p_{1B}^{pers}-p_{1A}^{pers}}{2t}}.$$

(10)

In the above, $x_0={\displaystyle \frac{1}{2}}+{\displaystyle \frac{p_{1B}^{pers}-p_{1A}^{pers}}{2t}}$ is the threshold value of consumers’ preference that makes the consumer indifferent between Firm A’s service and Firm B’s, below which consumers will purchase Firm A’s services.

We can calculate the demand for Firm A’s services as

$$D_{1A}^{pers}=(1-w){\int }_0^1{\int }_0^{x_0}dxdy=(1-w)({\displaystyle \frac{1}{2}}+{\displaystyle \frac{p_{1B}^{pers}-p_{1A}^{pers}}{2t}}).$$

(11)

The total market demand volume is quantified as 1, from which the total demand for Firm B’s services can be derived and expressed as

$$D_{1B}^{pers}=(1-w)(1-D_{1A}^{pers})=(1-w)({\displaystyle \frac{1}{2}}-{\displaystyle \frac{p_{1B}^{pers}-p_{1A}^{pers}}{2t}}).$$

(12)

From the above, we can derive the profit functions for Firm A and Firm B. Firm A chooses ${\widehat{p}}_{1A}^{pers}$ and ${\widehat{\sigma }}_{1A}$ to maximize ${\mathit{\pi }}_{1A}$ and Firm B chooses ${\widehat{p}}_{1B}^{pers}$ and ${\widehat{\sigma }}_{1B}$ to maximize ${\mathit{\pi }}_{1B}$, leading to the following first-order condition:

$${\displaystyle \frac{𝜕{\mathit{\pi }}_{1A}}{𝜕p_{1A}^{pers}}}=0,{\displaystyle \frac{𝜕{\mathit{\pi }}_{1A}}{𝜕{\sigma }_{1A}}}=0,{\displaystyle \frac{𝜕{\mathit{\pi }}_{1B}}{𝜕p_{1B}^{pers}}}=0,{\displaystyle \frac{𝜕{\mathit{\pi }}_{1B}}{𝜕{\sigma }_{1B}}}=0.$$

(13)

We can solve the first-order condition for the equilibrium results, which are given as follows:

$$\begin{array}{c}{\widehat{p}}_{1A}^{pers}={\widehat{p}}_{1B}^{pers}=t-\alpha -{\displaystyle \frac{{\alpha }^2(1-w)}{4K}},{\widehat{\sigma }}_{1A}={\widehat{\sigma }}_{1B}={\displaystyle \frac{\alpha (1-w)}{4K}},{\widehat{D}}_{1A}^{pers}={\widehat{D}}_{1B}^{pers}={\displaystyle \frac{1}{2}}(1-w),\\ {\widehat{\mathit{\pi }}}_{1A}={\widehat{\mathit{\pi }}}_{1B}={\displaystyle \frac{t(1-\mathrm{w})}{2}}-{\displaystyle \frac{{\alpha }^2{(1-w)}^2}{16K}},\\ \widehat{CS}=\left(1-w\right)[R+s+\alpha +{\displaystyle \frac{{\alpha }^2(1-w)}{4K}}-{\displaystyle \frac{5t}{4}}-{\displaystyle \frac{1}{2}}].\end{array}$$

(14)

Model analysis shows that prior to policy intervention, firms maintained a strategic equilibrium in the personalized service market, with competition driven by preference proximity. In practice, this reflects pre-regulation states in services where data monetization incentivizes price adjustments but symmetric competition limits deviations.

Corollary 1. 

For the first period, we have

$$\begin{array}{c}{\displaystyle \frac{𝜕{\widehat{p}}_{1A}^{pers}}{𝜕\alpha }}<0,{\displaystyle \frac{𝜕{\widehat{p}}_{1B}^{pers}}{𝜕\alpha }}<0,{\displaystyle \frac{𝜕{\widehat{\sigma }}_{1A}}{𝜕\alpha }}>0,{\displaystyle \frac{𝜕{\widehat{\sigma }}_{1B}}{𝜕\alpha }}>0.\\ {\displaystyle \frac{𝜕{\widehat{p}}_{1A}^{pers}}{𝜕K}}>0,{\displaystyle \frac{𝜕{\widehat{p}}_{1B}^{pers}}{𝜕K}}>0,{\displaystyle \frac{𝜕{\widehat{\sigma }}_{1A}}{𝜕K}}<0,{\displaystyle \frac{𝜕{\widehat{\sigma }}_{1B}}{𝜕K}}<0.\\ {\displaystyle \frac{𝜕{\widehat{p}}_{1A}^{pers}}{𝜕t}}>0,{\displaystyle \frac{𝜕{\widehat{p}}_{1B}^{pers}}{𝜕t}}>0.\end{array}$$

(15)

Equilibrium prices decrease with $\alpha$ but increase with $K$ and $t$, while inference accuracy rises with $\alpha$. Specifically, a higher parameter $\alpha$ signifies greater monetization potential of user data, thereby strengthening firms’ incentives to compete for users by lowering prices and accumulating data assets. This is commonly observed in e-commerce platforms employing strategies such as “free trials” or “loss leaders.” A higher parameter $t$, representing the strength of consumer brand preference, leads to a reduced willingness to switch among consumers. This, in turn, weakens price competition and diminishes consumer choice, consequently driving up equilibrium prices. A higher parameter $K$, the cost of inference precision investment, diminishes the efficiency with which firms can recoup returns from data monetization. This consequently reduces their incentive to lower prices to attract users, also tending to elevate prices. Therefore, increases in $t$ and $K$ reduce the utility derived from the same service by raising prices, directly eroding consumer welfare. Conversely, a higher $\alpha$ intensifies price competition, thereby lowering service prices and increasing consumer surplus.

4.2. Equilibrium After the Privacy Protection

In the second period, fundamentalists consider only purchasing standardized services from Firm A. When $U_{2A}^{std}$ > 0, they opt to purchase standardized services; otherwise, they abstain from any purchase. Because the utility brought by personalized services is significant enough, the unconcerned and pragmatists do not consider acquiring standardized services, focusing solely on the purchase of personalized services from either Firm A or Firm B.

Fundamentalists of type ($x$, $y$) buy Firm A’s standardized service if and only if

$$U_{2A}^{std}>0\Rightarrow x<{\displaystyle \frac{R-p_{2A}^{std}}{t}}.$$

(16)

In the above, $x_1={\displaystyle \frac{R-p_{2A}^{std}}{t}}$ is the threshold value of consumers’ preference, above which consumers will not purchase a service.

The unconcerned and pragmatists of type $(x,y)$ buy Firm A’s personalized service if and only if

$$U_{2A}^{pers}>U_{2B}^{pers}\Rightarrow x<{\displaystyle \frac{1}{2}}+{\displaystyle \frac{p_{2B}^{pers}-p_{2A}^{pers}}{2t}}.$$

(17)

In the above, $x_2={\displaystyle \frac{1}{2}}+{\displaystyle \frac{p_{2B}^{pers}-p_{2A}^{pers}}{2t}}$ is the threshold value of consumers’ preference, below which consumers will purchase Firm A’s personalized service.

We can calculate the demand for Firm A’s standardized services as

$$D_{2A}^{std}=w{\int }_0^{x_1}dx=w{\displaystyle \frac{w(R-p_{2A}^{std})}{t}}.$$

(18)

The demand for personalized services from Firm A and Firm B can be respectively represented as

$$\begin{array}{c}{D}_{2A}^{pers}=(1-w){\int }_0^1{\int }_0^{x_2}dxdy=(1-w)({\displaystyle \frac{1}{2}}+{\displaystyle \frac{p_{2B}^{pers}-p_{2A}^{pers}}{2t}}),\\ D_{2B}^{pers}=(1-w){\int }_0^1{\int }_{x_2}^{1}dxdy=(1-w)({\displaystyle \frac{1}{2}}-{\displaystyle \frac{p_{2B}^{pers}-p_{2A}^{pers}}{2t}}).\end{array}$$

(19)

From the above, we can derive the profit functions for Firm A and Firm B. Firm A chooses $p_{2A}^{std}$, $p_{2A}^{pers}$ and ${\widehat{\sigma }}_{2A}$ to maximize ${\mathit{\pi }}_{2A}$ and Firm B chooses ${\widehat{p}}_{2B}^{pers}$ to maximize ${\mathit{\pi }}_{2B}$, leading to the following first-order condition:

$${\displaystyle \frac{𝜕{\mathit{\pi }}_{2A}}{𝜕p_{2A}^{std}}}=0,{\displaystyle \frac{𝜕{\mathit{\pi }}_{2A}}{𝜕p_{2A}^{pers}}}=0,{\displaystyle \frac{𝜕{\mathit{\pi }}_{2A}}{𝜕{\sigma }_{2A}}}=0,{\displaystyle \frac{𝜕{\mathit{\pi }}_{2B}}{𝜕p_{2B}^{pers}}}=0.$$

(20)

We can solve the first-order condition for the equilibrium results, which are given as follows:

$$\begin{array}{c}{\tilde{p}}_{2A}^{std}={\displaystyle \frac{R}{2}},{\tilde{p}}_{2A}^{pers}=t-\alpha -{\displaystyle \frac{2{\alpha }^{2}t(1-w)}{12Kt-{\alpha }^2(1-w)}},{\tilde{p}}_{2B}^{pers}=t-\alpha -{\displaystyle \frac{{\alpha }^{2}t(1-w)}{12Kt-{\alpha }^2(1-w)}},\\ {\tilde{\sigma }}_{2A}={\displaystyle \frac{3\alpha (1-w)t}{12Kt-{\alpha }^2(1-w)}},{\tilde{D}}_{2A}^{std}={\displaystyle \frac{wRt}{2}},{\tilde{D}}_{2A}^{pers}=\left(1-w\right)\{{\displaystyle \frac{1}{2}}+{\displaystyle \frac{{\alpha }^{2}t(1-w)}{2t[12Kt-{\alpha }^2\left(1-w\right)]}}\},\\ {\tilde{D}}_{2B}^{pers}=\left(1-w\right)\{{\displaystyle \frac{1}{2}}-{\displaystyle \frac{{\alpha }^{2}t(1-w)}{2t[12Kt-{\alpha }^2\left(1-w\right)]}}\},\\ {\tilde{\mathit{\pi }}}_{2A}={\displaystyle \frac{{wR}^2}{4t}}+{\displaystyle \frac{9K{t}^2\left(1-w\right)[8Kt-{\alpha }^2\left(1-w\right)]}{{[12Kt-{\alpha }^2(1-w)]}^2}},{\tilde{\mathit{\pi }}}_{2B}={\displaystyle \frac{2(1-w)t{[6Kt-{\alpha }^2(1-w)]}^2}{{[12Kt-{\alpha }^2(1-w)]}^2}},\\ \widetilde{CS}={\displaystyle \frac{w{R}^2}{8t}}+(1-w)\left(\mathrm{R}+\mathrm{s}+\mathsf{\alpha }-{\displaystyle \frac{5t+2}{4}}\right)-{\displaystyle \frac{3{\alpha }^2{t(1-w)}^2}{2\left[12Kt-{\alpha }^2\left(1-w\right)\right]}}+{\displaystyle \frac{{\alpha }^4{(1-w)}^{3}t}{4{\left[12Kt-{\alpha }^2(1-w)\right]}^2}}.\end{array}$$

(21)

It is easy to check from the above results that, after the policy protection, Firm A successfully attracts more consumers by setting personalized service prices below those of Firm B, thereby securing a higher demand share in the personalized service market. This pricing strategy not only enhances Firm A’s market share within the personalized segment but also results in its total profit surpassing that of Firm B. This finding indicates that under a policy environment that offers opt-out data tracking options, firms can effectively expand their market share by proactively lowering personalized service prices and by offering standardized services to attract privacy-conscious consumers. This illustrates how a compliance-first approach can be leveraged into a market-leading strategic advantage. In practice, companies that proactively internalize privacy protection as a product feature, such as platforms introducing incognito browsing modes, can cultivate a privacy-friendly brand perception. This, in turn, attracts a broad customer base, ranging from highly privacy-conscious users to the general public. In the era of data governance, competitive advantage is partially shifting from data monopolization to regulatory compliance innovation and trust-building. This necessitates that companies deeply integrate privacy protection into their competitive strategies. Through tiered product offerings, flexible pricing, and actively building user trust, regulatory pressures can be transformed into strategic opportunities for market redefinition and user base expansion. For regulators, this suggests that carefully designed, differentiated privacy policies can proactively shape a beneficial “asymmetric competition” market structure. Consequently, these policies can serve as a sophisticated regulatory tool, effectively stimulating market competition and innovation while simultaneously safeguarding privacy.

Notably, we assume that firms fully comply with regulatory requirements, aligning with the foundational assumptions in Choe et al. (2025) [11]. The stipulated penalty levels are sufficiently stringent to ensure corporate compliance. In reality, however, if government regulatory enforcement is suboptimal, firms A and B might engage in a degree of non-compliance subsequent to weighing the gains from violations against the penalties, thereby augmenting their own profits. Concurrently, the privacy costs incurred by consumers when selecting services from either firm would rise commensurately, yet this would not substantially alter their choice between firm A and firm B, thus leading to an anticipated lack of significant fluctuation in their respective market shares. Although the augmentation of consumer privacy costs alongside elevated firm profits could impact total social surplus, this alteration does not fundamentally affect the core conclusions of this study. Furthermore, the adoption of the “full corporate compliance” assumption facilitates a clearer identification and comparison of the differentiated policy effects, contingent upon controlling for the variable of compliant behavior. Consequently, the assumptions employed herein are both analytically sound and necessitated by the research design.

Corollary 2. 

For the second period, we have

$$\begin{array}{c}{\displaystyle \frac{𝜕{\tilde{p}}_{2A}^{pers}}{𝜕\alpha }}<0,{\displaystyle \frac{𝜕{\tilde{p}}_{2B}^{pers}}{𝜕\alpha }}<0,{\displaystyle \frac{𝜕{\tilde{\sigma }}_{2A}}{𝜕\alpha }}>0,\\ {\displaystyle \frac{𝜕{\tilde{p}}_{2A}^{pers}}{𝜕K}}>0,{\displaystyle \frac{𝜕{\tilde{p}}_{2B}^{pers}}{𝜕K}}>0,{\displaystyle \frac{𝜕{\tilde{\sigma }}_{2A}}{𝜕K}}<0,\\ {\displaystyle \frac{𝜕{\tilde{p}}_{2A}^{pers}}{𝜕t}}>0,{\displaystyle \frac{𝜕{\tilde{p}}_{2B}^{pers}}{𝜕t}}>0.\end{array}$$

(22)

The trends align with pre-policy patterns: prices decrease with $\alpha$ but rise with $K$ and $t$, while inference accuracy increases with $\alpha$. In practice, higher data value incentivizes price cuts in cloud services to expand share, but costs and preference intensity lead to higher pricing. Consumer surplus benefits from lower prices with higher $\alpha$ but declines with $K$ and $t$, underscoring trade-offs in privacy protection policies for service ecosystems.

5. Comparing the Equilibria Before and After the Privacy Protection

This section compares the equilibria before and after the privacy protection and discusses the welfare implications of the privacy protection policies in e-commerce. Our discussions of equilibrium price and equilibrium demand are based on the results from the previous section.

First, we find that personalized service prices change post-policy depending on $\alpha$, as stated in the following Proposition 1.

Proposition 1. 

If  $0<\alpha <{\alpha }_1$, $\Delta p_A^{pers}>0$ and $\Delta p_B^{pers}>0$ ; If ${\alpha }_1<\alpha <{\alpha }_2$ , $\Delta p_A^{pers}<0$ and $∆p_B^{pers}>0$ ; If $\alpha >{\alpha }_2$ , $\Delta p_A^{pers}<0$ and $∆p_B^{pers}<0$ , where ${\alpha }_1$ and ${\alpha }_2$ are given by ${\alpha }_1=\sqrt{{\displaystyle \frac{4Kt}{1-w}}}$ , ${\alpha }_2=\sqrt{{\displaystyle \frac{8Kt}{1-w}}}$.

Following privacy protection policy implementation, the sources of profit for the two firms undergo significant shifts. Firm B experiences a reduction in profits derived from data, whereas Firm A is able to generate additional revenue through standardized services. Proposition 1 indicates that when the data value parameter $\alpha$ is relatively low, say $0<\alpha <{\alpha }_1$, both firms tend to increase their prices post-policy (i.e., $\Delta p_A^{pers}>0$ and $\Delta p_B^{pers}>0$), rather than engaging in price competition to capture market share. This behavior stems from firms attempting to offset decreased income due to policy-imposed data restrictions by raising prices, thereby avoiding price wars.

As the data value $\alpha$ increases, the competitive dynamics shift. When $\alpha$ falls within the interval ${\alpha }_1<\alpha <{\alpha }_2$, Firm A adopts a price reduction strategy, while Firm B continues to raise prices (i.e., $\Delta p_A^{pers}<0$ and $∆p_B^{pers}>0$). This phenomenon occurs because, following the privacy protection policy, Firm A secures a larger market share, and price reductions induce greater consumer demand changes, enabling Firm A to seize early advantages in the personalized market. Consequently, Firm A’s personalized service prices fall below pre-policy levels.

When the data value $\alpha$ surpasses the threshold ${\alpha }_2$, market competition intensifies. Both firms reduce prices to compete in the personalized service segment (i.e., $\Delta p_A^{pers}<0$ and $∆p_B^{pers}<0$). At this point, prices for personalized services fall below pre-policy levels, as firms sacrifice unit margins to attain larger market shares and long-term data benefits.

Overall, the policy reshapes corporate pricing strategies by altering consumer behavior and the data value threshold. In usage-driven firms, policies tend to result in price increases, whereas in data-driven firms, such policies are associated with price reductions. Parameters $K$, $t$, and $w$ jointly determine the position of the critical $\alpha$ point, thereby influencing market equilibrium.

Our next result shows how the policies change the equilibrium demand of personalized services and we derive the result in Proposition 2.

Proposition 2. 

Comparing the equilibrium demand of personalized services before and after the privacy protection, we find that the total demand for Firm A’s personalized services increases after the privacy protection, whereas the total demand for Firm B’s personalized services accordingly decreases.

The phenomenon revealed in Proposition 2 fundamentally stems from the diversification of profit sources for Firm A following the implementation of the privacy policy. Firm A is able to extract additional data value from consumers who opt to share their information, thereby increasing the marginal profit per unit of service. Consequently, Firm A is strongly incentivized to adopt moderate price reductions to expand its market share. This data-driven aggressive pricing strategy ultimately enables Firm A to gain a competitive advantage, effectively eroding Firm B’s market share.

Next we discuss the policies’ impact on the firms’ profit. Following the analytical approach proposed by Yu et al. (2020), we employ numerical methods to analyze. We set $K$ = 1 and t = 1 to simplify the discussion of consumers’ preference intensity parameter and inference investment cost intensity parameter and other values of $K$ and $t$ are discussed in Section 6.3 [46]. We discuss the case where $R$ = 1 and the results for general values of $R$ are shown in Appendix A.

Proposition 3. 

The equilibrium profit of Firm A is higher after the privacy protection, that is,   $∆{\mathit{\pi }}_A$$=$ ${\tilde{\mathit{\pi }}}_{2A}-{\widehat{\mathit{\pi }}}_{1A}$ > 0. Firm B’s profit is smaller after privacy protection, that is, $∆{\mathit{\pi }}_B={\tilde{\mathit{\pi }}}_{2B}-{\widehat{\mathit{\pi }}}_{1B}$ < 0.

Proposition 3 indicates that the implementation of Policy A enhances the profitability of Firm A. Under competitive conditions, demand for Firm A’s personalized services increased relative to the pre-policy period, as demonstrated in Proposition 2. Post-implementation, Firm A’s profit structure diversified, enabling Firm A to generate additional revenue not only from personalized services but also from standardized services. Even when data value resides within a lower interval (i.e., $\alpha <{\alpha }_1$), although the pricing of personalized services by Firm A decreased compared to the pre-policy level, the negative impact of price reduction on profits was offset by the positive effect of increased demand, resulting in an overall profit growth.

Conversely, Policy B led to a decline in Firm B’s profits. Following policy implementation, demand for Firm B’s personalized services decreased relative to the pre-policy period. While Firm B attempted to compensate for this loss by raising prices on personalized services within the data value interval ($\alpha <{\alpha }_2$), the positive effect of price increases on profits was insufficient to counterbalance the negative impact of demand contraction, ultimately resulting in a reduction in Firm B’s profits post-policy.

Proposition 4. 

After the implementation of the two policies, the direction of change in consumer surplus under competitive conditions primarily depends on the magnitude of the data value parameter   $\alpha$ : when $\alpha$ is relatively high, that is, $\alpha >{\alpha }_3(w)$, consumer surplus is lower. Conversely, when $\alpha$  is relatively low, that is, $\alpha <{\alpha }_3(w)$, consumer surplus is higher. The proportion of privacy fundamentalists, $w$, modulates the extent of this effect but does not alter the fundamental trend.

Proposition 4 delineates the changes in total consumer surplus before and after the implementation of two privacy protection policies. Figure 2 visually illustrates the distribution of these changes across two dimensions: data value and the proportion of privacy fundamentalists. As depicted, whether consumer surplus improves or deteriorates post-policy is not determined by a single factor but results from the complex interplay between the parameters $\alpha$ and $w$. The blue-shaded region indicates policy effectiveness, where consumer surplus is larger after the privacy protection, whereas the red-shaded region signifies potential unintended negative effects under certain conditions. The black curve explicitly delineates the critical threshold at which policy effects transition from positive to negative. The data value $\alpha$ is identified as the pivotal variable influencing policy outcomes. Generally, when the proportion of fundamentalists remains fixed, privacy protection policies are more likely to increase consumer surplus when $\alpha$ is smaller. This is because, when the parameter $\alpha$ is relatively small, firms offering personalized services under the policy tend to set higher prices, pushing the market toward a near-monopoly state. Although, as demonstrated in Proposition 1, both Firms A and B increase their prices for personalized services following policy implementation, the limited magnitude of price increases is constrained. In this scenario, the introduction of standardized services attracts fundamentalists into the market, generating a significant demand expansion effect. This effect is sufficient to offset the negative impact of rising prices, resulting in an overall increase in consumer surplus. Conversely, when $\alpha$ is relatively large, the demand for personalized services from Firm A exhibits a notable increase as prices decline, as indicated by the reallocation term in the demand function. However, this demand redistribution also prompts more consumers to choose services that do not fully align with their preferences, leading to substantial matching utility losses. Although price reductions are inherently beneficial to consumers, the adverse effects of preference mismatches dominate, causing a decrease in consumer surplus for the personalized service segment. Simultaneously, the consumer surplus gained from standardized services is relatively limited, ultimately leading to a decline in total consumer surplus. Therefore, the welfare-enhancing effect of the policies is more likely in usage-driven firms, whereas their welfare-reducing effect is more likely in data-driven firms.

The proportion of fundamentalists plays a crucial moderating role. When the ratio of privacy pragmatists is excessively low, the existence of demand redistribution effects tends to lead to a decline in consumer surplus. Conversely, when the proportion of fundamentalists is relatively high, policies are more likely to enhance consumer surplus. The introduction of standardized services through policy successfully converts fundamentalists from non-buyers to buyers, generating a substantial demand-creating effect. The resulting increase in consumer surplus from this effect is significant enough to offset potential negative impacts of the policy on the market for personalized services.

Proposition 5. 

After the implementation of the two policies, the direction of change in total surplus under competitive conditions primarily depends on the magnitude of the data value parameter  $\alpha$ : when  $\alpha$  is relatively high, that is,  $\alpha >{\alpha }_4(w)$, total surplus is lower. Conversely, when  $\alpha$  is relatively low, that is,  $\alpha <{\alpha }_4(w)$, total surplus is higher. The proportion of privacy fundamentalists,  $w$, modulates the extent of this effect but does not alter the fundamental trend.

Proposition 5 elucidates the variations in total social surplus under the influence of privacy policies. Figure 3 visually illustrates the distribution of these changes across two dimensions: data value and the proportion of privacy fundamentalists. The effect of privacy protection policies on total surplus is similar to that on consumer surplus because total surplus is the sum of profit and consumer surplus. The blue-shaded region indicates that when the data value $\alpha$ is relatively low, the implementation of the policy results in an overall increase in social welfare. This outcome is primarily driven by the demand-creating effects induced by the policy, which dominate the market dynamics: the policy successfully incentivizes a substantial number of fundamentalists to transition from non-purchasers to consumers of standardized services, thereby significantly enhancing consumer surplus. Concurrently, under low $\alpha$ conditions, data monetization contributes minimally to corporate profits; the intensified competition triggered by the policy exerts a relatively small negative impact on Firm B’s profitability, while Firm A’s profits may actually increase due to the expansion into new markets. Consequently, the net effect is an overall gain in total surplus. Conversely, in the red-shaded region, where the data value $\alpha$ is relatively high, the policy may lead to a decline in social welfare. Under these circumstances, the competitive effects of the policy become more pronounced. A high $\alpha$ signifies that data has become a core source of profit for firms; the policy implementation exacerbates market competition: on the one hand, firms engage in price wars to compete for user data, significantly harming Firm B’s profits; on the other hand, demand reallocation results in increased mismatches in consumer preferences, thereby diminishing consumer surplus gains. Ultimately, the substantial reduction in Firm B’s profits, the limited increase in Firm A’s profits, and the stagnation or reduction in consumer surplus collectively lead to a net decrease in total surplus.

In conclusion, the impact of privacy protection policies on total social welfare is not unidirectional and depends on industry data value and consumer structures. Crucially, a critical threshold of data value marks the inflection point where policy effects shift from enhancing to diminishing welfare. This finding suggests that uniform privacy regulations are inadvisable and should instead provide differentiated guidance for policymaking and corporate strategy. From an industrial perspective, this threshold effectively delineates regulatory sensitive zones for usage-driven and data-driven firms. For usage-driven firms, such as ride-hailing services and foundational software, whose data value is typically lower and whose business models prioritize service transactions over data monetization, aggregate social welfare is consequently enhanced. Conversely, for data-driven enterprises, like social media platforms reliant on targeted advertising or e-commerce recommendation engines, these policies result in a net loss of aggregate social welfare. Therefore, regulation should be precisely tailored to industry attributes: privacy protection can be actively promoted in usage-driven sectors, while data-driven sectors require cautious design and supporting measures to mitigate adverse impacts. Concurrently, firms should conduct strategic assessments accordingly: high-data-value enterprises should explore alternative revenue models to reduce data dependency, whereas low-data-value enterprises can proactively leverage compliance as a differentiated advantage, pioneering privacy-friendly markets.

6. Model Extensions

6.1. Robustness to Parameters K and T

In the baseline model, we set the inference investment cost intensity parameter ($K$) and the consumers’ preference intensity parameter ($t$) both to 1 to simplify the discussion of inference cost coefficients and preference deviation coefficients. Depending on e-commerce platforms, market environments are often diverse: consumer preference biases may be relatively high, as in luxury goods markets, or relatively low, as in everyday consumer goods markets. Simultaneously, firms’ inference costs can vary due to technological capabilities or regulatory policies; for example, stringent privacy regulations may increase compliance costs, thereby elevating the $K$ value, while advancements in technology can reduce it. To assess the generalizability of the baseline model’s conclusions, this section systematically varies the values of $K$ and $t$ to simulate different market conditions and test the robustness of the model. We consider five cases: (1) $K$ = 2, $t$ = 2; (2) $K$ = 0.5, $t$ = 0.5; (3) $K$ = 2, $t$ = 0.5; (4) $K$ = 0.5, $t$ = 2; and (5) $K$ = 0.2, $t$ = 0.2. These scenarios encompass a range from low to high consumer preference deviations and inference costs, aiming to evaluate the effectiveness of privacy policy combinations across different environments. For each case, we analyze the firms’ pricing strategies, profit changes, consumer surplus, and total social surplus before and after policy implementation, comparing these outcomes with the conclusions derived from the baseline model.

The results for cases 1 to 4 are highly consistent with the conclusions of the baseline model, indicating its robustness. Following policy implementation, the personalized service prices of Firms A and B both exceeded pre-policy levels, attributable to firms offsetting fluctuations in data monetization revenues through price increases. Post-policy, Firm A experienced a general profit increase, whereas Firm B’s profits declined. This trend is observed across all cases, confirming the asymmetric impact of policies on the competitive landscape within the baseline model. Changes in consumer surplus across these scenarios are primarily dependent on the data value parameter $\alpha$; when $\alpha$ is small, consumer surplus increases, whereas larger $\alpha$ values lead to a reduction. The variation in total surplus is similar to this pattern, driven jointly by firm profits and consumer surplus. The proportion of fundamentalists, $w$, functions as a moderating factor; higher $w$ amplifies the policy gains. Although there are subtle differences in case 5, the primary conclusion of the main model remains valid. These patterns align entirely with the baseline model, indicating that variations in parameters $K$ and $t$ do not alter the underlying economic mechanisms.

6.2. Stepwise Optimization of Pricing and Inference Accuracy

Our baseline model assumes that firms simultaneously determine service pricing and inference accuracy to maximize profits, optimizing price and inference precision in tandem. However, in real-world decision-making, firms often adopt a more sequential approach: initially observing market conditions and then adjusting data inference strategies to incrementally enhance profitability. This stepwise decision process is particularly prevalent in e-commerce. To capture this complexity, the current model is extended to examine firms’ sequential optimization strategies: in the first stage, firms prioritize setting prices to maximize short-term profits; in the second stage, given the established price, they optimize inference accuracy to improve long-term data monetization. This analysis aims to elucidate how the order of decisions influences the interaction between pricing and inference precision, thereby affecting firm profits and market efficiency, and to compare these findings with the baseline model to assess robustness.

This sequential decision-making process reflects a corporate strategy of initial pricing followed by adjustments in practical operations, whereby firms first attract users through low prices and subsequently utilize generated data to optimize recommendation algorithms. Compared to the baseline model, the personalized service prices within the stepwise optimization framework are generally lower, driven by short-term profit maximization. In the initial stage, firms prioritize market share competition, favoring price reductions to stimulate demand. Due to the unoptimized nature of inference accuracy, firms cannot rely on data-driven revenue to offset losses from low prices, resulting in more aggressive pricing strategies. For instance, firms may set prices below the level of synchronized optimization to rapidly acquire users. In the stepwise model, the critical threshold at which the post-policy prices of Firm A and Firm B shift from increasing to decreasing exceed that of the main model, indicating an expanded range of data value supporting higher prices. This occurs because Firm A, post-policy, focuses more on price competition with Firm B. However, the sequential decision process induces greater caution: during the initial pricing stage, firms fail to fully anticipate the inference accuracy gains in the second stage, leading to delayed price reductions in high-alpha regions.

Although the prices and thresholds differ between the stepwise and main models, the core conclusions remain consistent. The stepwise decision process does not alter these fundamental economic mechanisms but merely adjusts parameter sensitivities. Under the stepwise framework, policy effects continue to depend on $\alpha$ and $w$, confirming the robustness of the baseline model’s findings.

6.3. Data Externalities

In privacy protection policy analysis, data externalities refer to the effects of individual data accumulation on third-party utility, a phenomenon particularly significant in competitive markets [9]. These externalities can be classified into positive and negative categories: positive externalities arise from information benefits and service improvements facilitated by data sharing, while negative externalities are associated with privacy concerns and price discrimination. This section is based on the frameworks established by Hitt (2010) and Belleflamme et al. (2016) [47,48]. We examine how data externalities influence consumer utility, firm pricing strategies, and market equilibrium, ultimately shaping total surplus. Compared to the baseline model, this analysis introduces parameters $\theta$ and $\lambda$ to quantify the intensities of positive and negative externalities respectively and assumes that firms A and B do not share data to preserve competitive dynamics. The focus centers on consumers opting into personalized services, as they are the primary beneficiaries or victims of data externalities.

6.3.1. Positive Data Externalities

Positive externalities in data-driven contexts manifest as data accumulation that enhances consumer utility. As an increasing number of consumers adopt personalized services, firms can leverage data to refine their services, such as improving recommendation algorithm accuracy or reducing consumer search costs, thus generating additional value for consumers. This effect arises not only from direct informational gains, such as more precise service matching, but also from economies of scale enabling data refinement, where expanding user bases permit firms to optimize predictive models and thereby enhance service quality [7,43,49]. In modeling terms, these positive externalities are reflected in the utility function through the $\theta D_i^{pers}$ component ($\theta >0$), where $D_i^{pers}$ denotes demand for personalized services. For example, prior to policy implementation, the utility functions for consumers purchasing personalized services from firms A and B are represented accordingly:

$$\begin{gathered} U_{1A}=R-p_{1A}-y+s-tx+\theta D_{1A}^{pers}, \\ {U}_{1B}=R-p_{1B}-y+s-t+tx+\theta D_{1B}^{pers}. \end{gathered}$$

(23)

Similarly, consumer utility following policy implementation also incorporates analogous components. This design captures prevalent network effects within platform economies, such as the enhanced user experience resulting from increased user base in social media or platforms. Under positive externalities, firms tend to reduce prices for personalized services to attract a larger user cohort, thereby expanding the data network. However, this intensifies inter-firm competition, leading to profit margins contraction. Consumers benefit from lower prices and improved services, resulting in increased consumer surplus. Notably, post-policy, Firm A, endowed with a higher market share, is better positioned to leverage positive externalities for competitive advantage, although its profit growth may be mitigated by intensified competition. Overall, positive externalities lower the price change threshold—prompting firms to initiate price reductions earlier—while the trend of welfare changes remains consistent with the baseline model, thereby underscoring the robustness of the theoretical framework.

6.3.2. Negative Data Externalities

Negative externalities reflect the utility losses arising from data misuse. As data accumulates, firms may engage in price discrimination or spark privacy concerns, thereby reducing consumers’ net utility [8,48,50,51]. For instance, personalized pricing based on user data can result in certain consumers paying higher prices, while increased privacy invasion risks diminish consumer trust and satisfaction. In the model, negative externalities are represented by $\lambda D_i^{pers}$ ($\lambda$ > 0), leading to the utility function of consumers purchasing personalized services being modified as follows:

$$\begin{gathered} U_{2A}=R-p_{2A}-y+s-tx-\lambda D_{2A}^{pers}, \\ {U}_{2B}=R-p_{2B}-y+s-t+tx-\lambda D_{2B}^{pers}. \end{gathered}$$

(24)

This indicates that increased demand for personalized services actually reduces utility, as data utilization amplifies privacy costs. Under negative externalities, firms face pressure from declining demand and consequently raise prices to offset profit losses. Post-policy implementation, this effect becomes more pronounced: prices of personalized services from Firms A and B rise, the threshold for price adjustments increases, and firms delay price reductions to counteract demand contraction driven by privacy concerns. While consumer surplus diminishes, changes in firm profits remain consistent with the core model, as the negative externality partially offsets competitive pressures. Importantly, the negative externality does not fundamentally alter the principal conclusions of the baseline model.

7. Conclusions and Implications

This study analyzes the effects of privacy protection policies in e-commerce, such as modern software systems and cloud platforms, by constructing a duopoly model. The analysis compares two policy instruments—the opt-in requirement and inference regulation—to determine which more effectively balances privacy information preservation with commercial efficiency. Through contrasting these policies, this study elucidates the mechanisms underlying their impacts, providing a practical framework for policy design in digital ecosystems. Specifically, Policy A mandates that Firm A offer opt-out purchase, while Policy B bans inference-based data processing. The model incorporates consumer heterogeneity along two dimensions: locations in terms of preferences and privacy costs, categorizing consumers into privacy fundamentalists, pragmatists, and the unconcerned. By analyzing equilibrium states before and after policy implementation, this study reveals how these policies influence firms’ pricing strategies, market shares, profit distribution, and consumer surplus. We further explore the roles of parameters such as the value of consumer data, $\alpha$; the inference investment cost intensity parameter, $K$; and the consumers’ preference intensity parameter, $t$, thereby illustrating the complex dynamics engendered by policies in competitive environments.

Initially, it is demonstrated that the impact of differentiated policies on equilibrium prices depends on firms’ revenue models. For usage-driven firms with lower data value, such as ride-hailing platforms, equilibrium prices of personalized services tend to increase post-policy. Conversely, in data-driven firms characterized by higher data value, such as affiliate marketing platforms and price comparison search engines, differentiated policies lead to a reduction in personalized service prices.

Subsequently, the effects of differentiated policies on market demand and equilibrium profits are examined. The opt-in requirement—while restricting Firm A’s data collection—also provides opportunities for profit diversification through standardized services. Implementation of privacy protection policies enhances Firm A’s profit sources, permitting additional value extraction from consumers sharing information, thus increasing the marginal profit per unit, leading to overall profit growth. Conversely, such policies reduce Firm B’s profits, reflecting a competitive advantage for firms adopting the opt-in requirement.

The influence of policies on consumer surplus is intimately connected to firms’ revenue models. When the proportion of privacy fundamentalists is fixed and the data value $\alpha$ is relatively high, consumer surplus declines. Conversely, when $\alpha$ is lower, consumer surplus increases. The proportion of fundamentalists, $w$, modulates the magnitude of this effect but does not alter the fundamental trend. This is attributable to the fact that, for relatively small data value, $\alpha$, policy-induced price increases on personalized services are limited, as prices are close to monopoly levels, constraining the extent of price hikes. The introduction of standardized services attracts fundamentalists, generating a demand expansion that compensates for the negative effects of price increases, thus elevating total consumer surplus. Conversely, when $\alpha$ is large, firms’ price reductions aimed at increasing demand for personalized services may induce consumers to choose mismatched offerings, leading to a loss in match utility. Despite the increased demand for personalized services, preference mismatch dominates, reducing consumer surplus.

The subsequent analysis demonstrates the influence of parameters on equilibrium results. The equilibrium price of personalized services exhibits a negative correlation with the value of consumer data value, $\alpha$, while showing positive correlations with inference investment cost intensity parameter, $K$, and consumers’ preference intensity parameter, $t$. This suggests that higher data investment costs or increased service differentiation lead firms to set higher prices to recover costs or leverage market power. Conversely, higher data value encourages price reductions to capture data market share and expand market size. Prior to policy implementation, an increase in data value results in Firms A and B engaging in price competition without altering market share, ultimately reducing both firms’ profits. Post-policy, as data value increases, Firm A’s profitability surpasses that of Firm B due to asymmetric competitive advantages; Firm A benefits more significantly, while Firm B’s profits diminish.

These findings imply that differentiated policies primarily impact prices and consumer surplus contingent upon the value of consumer data to the firms. Usage-driven firms are more likely to experience welfare enhancement and price reductions, whereas data-driven firms tend to experience welfare reduction and price increases. In markets characterized by lower data value, these policies primarily stimulate suppressed demand by enhancing competition, reducing prices, and bolstering consumer trust, thereby augmenting aggregate social welfare. Conversely, markets with high data value may experience a net loss in total welfare. From a corporate perspective, differentiated privacy protection policies tend to favor usage-driven firms more than data-driven firms, presenting potential challenges for the latter. Post-implementation, data-driven enterprises must concentrate on diminishing their reliance on data-driven revenue streams and develop novel monetization strategies, such as incorporating value-added subscription services within platform offerings. In contrast, usage-driven firms can leverage privacy protection as a strategic opportunity to consolidate trust and expand market share. Such differentiated policies induce asymmetric competition between Firm A and Firm B, effectively circumventing prisoner’s dilemma scenarios [44,52]. Implementing the opt-in requirement provides a competitive advantage to Firm A. To adopt such policies, governments might consider subsidizing Firm B to balance privacy protection with business efficiency.

While the primary conclusions derive from the policy environment analyzed, they also offer significant strategic insights for firms. The study shows that, under competitive conditions, firms that voluntarily offer opt-in options or explicitly define data collection boundaries can establish a competitive edge. Importantly, this advantage does not rely solely on restrictive data usage regulations. Firms should recognize that privacy compliance represents a strategic variable capable of reshaping market dynamics rather than merely a compliance cost. Integrating privacy regulation strategies with market competitiveness considerations enables firms to proactively explore avenues to meet legal requirements while transforming compliance into a differentiating advantage.

Further, this study emphasizes that differentiated policies effectively create asymmetries among competitors, discouraging cooperative prisoner’s dilemma outcomes. Firms adopting the opt-in requirement are positioned more favorably. Policymakers should consider deploying differentiated policy tools across various market segments, imposing tailored obligations on different firms. Support mechanisms such as subsidies for less competitive firms can help balance market effects. Before implementing privacy regulations, regulators should evaluate the business models and data value pertinent to specific industries. For high-value sectors like data-intensive analytics services, policies should be cautiously designed with appropriate transitional arrangements to ensure smooth implementation. For firms whose revenue is less dependent on data, offering privacy protections to customers can be a viable consideration.

This study primarily employs a combined methodology of theoretical modeling and quantitative analysis. Future research can explore several valuable directions building upon the results of this study. The model has, to some extent, considered the heterogeneity between consumers and firms across different cultural backgrounds. For instance, differences in privacy perceptions between Asia and Europe can lead to varying levels of privacy concern and consequent behaviors, thereby influencing the proportion of privacy fundamentalists within consumer segments. Regional industry characteristics also differ, and these factors may alter the policy effectiveness threshold, although the main conclusions of this study remain valid. However, it should be noted that diverse cultural backgrounds and legal systems may induce deeper-seated heterogeneity, subsequently producing differentiated impacts on the implementation effectiveness of privacy protection policies. Therefore, future research could conduct cross-cultural comparative analyses to systematically assess the applicability and efficacy of differentiated privacy protection policies across various institutional contexts, thereby providing a theoretical basis for privacy regulatory coordination in the era of globalization. Furthermore, consumers’ privacy preferences in reality may evolve with personal experiences, data breach incidents, or shifts in public opinion. Subsequent research could attempt to construct endogenous switching mechanisms for consumer types, further examining how external events or firm strategies dynamically influence market structure, and analyzing the impact of such evolution on the long-term policy effects. In terms of model specification, this study focuses on a duopolistic competition framework; future work could extend the analysis to multi-firm competition scenarios to investigate the synergistic effects and diffusion mechanisms of policies within more complex market structures. Empirically, the theoretical findings of this study can be tested using econometric methods such as natural experiments and difference-in-differences, thereby enhancing the real-world interpretability of the conclusions. Beyond these aspects, specific design features of privacy protection policies, such as the format, timing, and presentation of disclosures, may also significantly moderate consumers’ cognitive and behavioral responses, constituting another avenue worthy of in-depth exploration. By examining policy types and their interaction effects more broadly, a more systematic and comprehensive policy evaluation perspective can be gradually formed.