General Data Protection Regulation (GDPR) and Cross-Border M&A by Chinese E-Commerce Firms

Abstract

The General Data Protection Regulation (GDPR), adopted by the European Union in 2018, aims to enhance consumer trust and market efficiency by strengthening data protection. The concurrent stringent compliance requirements raise operational costs and could reshape competition by favoring larger firms with greater regulatory capacity. While the GDPR reduces data-related risks and promotes global digital trade through its extraterritorial reach, the potential advantage to larger firms could incentivize strategic responses such as mergers and acquisitions (M&A) to consolidate market power. Given the rapid expansion of Chinese digital firms in e-commerce, social media, and cloud services across the EU, this study examines how the GDPR has affected their cross-border M&A activities between 2014 and 2021. Based on difference-in-difference analysis, the study finds that the GDPR did not have a statistically significant impact on the number or value of mergers and acquisitions by Chinese digital firms in the EU in the short term. This suggests that firms may enhance their institutional adaptability by strengthening their compliance capabilities. However, institutional and cultural differences pose long-term entry barriers for the firms. The study contributes by highlighting how firms adjust internationalization strategies under stringent regulatory regimes, offering policy-relevant insights for governments and regulatory authorities.

1. Introduction

Cross-border mergers and acquisitions (M&A) allow companies to rapidly acquire market channels, digital capabilities and technological resources in host countries, enhancing their dynamic comparative advantages (Erel et al., 2012). In the contemporary digital economy era, data emerges as a key production factor (Jia et al., 2021). However, data protection and privacy concerns lead to a stringent regulatory framework worldwide (Chen, 2021). This poses data-related regulatory constraints as a new challenge for data-driven businesses seeking to expand globally.

The European Union formally implemented the General Data Protection Regulation (GDPR) in 2018, which is considered one of the most stringent privacy and data security governance regimes (Wolford, 2025). This regulation has two main impacts: the first is that firms must utilize GDPR-compliant processes and techniques, which implies a significant increase in operational and compliance costs (Presidente & Frey, 2022). Secondly, the strict data sharing and user-consent mechanisms also increase the cost of data collection and impact their ability to access the data (Presidente & Frey, 2022). Therefore, the implementation of the GDPR has created new challenges for Chinese digital firms in cross-border M&A activities.

Although extant literature examines firms’ global expansion as strategic moves to reap the benefits of comparative advantage, the literature does not systematically integrate the determinants of cross-border mergers and acquisitions and the economic impact of the GDPR. Existing studies often focus on traditional industries or US- and EU-based sectors and mainly analyze the effects of regulation at the operational level of firms. However, there is still a lack of empirical evidence on how regulation affects firms’ strategic decisions, especially their cross-border M&A activities (Brakman et al., 2005; Congiu et al., 2022; Jia et al., 2021). Gilroy and Lukas (2006) show that compared to general market entry, cross-border M&A involves not only capital flow but also resource integration, and thus cross-border M&A can better reflect firms’ strategic decision-making in complex environments.

This study uses a country–year aggregation strategy to examine the impact of the GDPR on the cross-border M&A activities of Chinese digital firms. By aggregating firm-level M&A events of Chinese digital firms from the SDC database from 2014 to 2021 and using a DID analytical framework, this study considers both time effects and country-specific characteristics. This allows for a more comprehensive understanding of how regulatory shocks influence M&A behavior across different markets and time periods. This paper contributes to the emerging literature at the intersection of digital regulation, cross-border M&A, and emerging market firms. It also provides new empirical evidence and theoretical explanations for understanding how firms reconstruct their competitive advantages under global digital governance.

The empirical results do not provide sufficient evidence that the GDPR significantly inhibited the cross-border M&A activities of Chinese digital firms in the EU in the short term. However, institutional and market-entry barriers in the EU may still pose longer-term challenges for these firms. Based on these findings, the paper provides a possible theoretical perspective on how emerging market firms respond to external regulatory shocks by improving their compliance capabilities and institutional adaptability. Although this study does not find a significant inhibitory effect of the GDPR on Chinese firms’ cross-border M&A behavior in the short term, this result provides suggestive evidence on how emerging market firms may adjust their internationalization strategies in the context of globalization and the digital economy in order to respond to a dynamic global regulatory environment.

The main contribution of this study is that it provides empirical evidence on the relationship between the GDPR and the cross-border M&A behavior of Chinese digital firms, primarily highlighting their institutional adaptation in cross-border M&A, a context that remains relatively underexplored in the existing literature. In addition, this study integrates the theory of comparative advantage with the institutional adaptation perspective, explaining how firms respond to strict regulatory requirements through institutional adaptability in the context of the digital economy. Although this study does not find a statistically significant inhibitory effect of the GDPR on the cross-border M&A behavior of Chinese digital firms in the short term, this finding may provide additional insights into institutional adaptation theory, especially regarding the relationship between cross-border M&A and institutional adaptability. This study further discusses the profound influence of factors such as institutional adaptability and market entry barriers, and provides strategic implications for firms during international expansion, especially regarding how digital firms deal with regulatory differences and entry barriers in international markets.

2. Theoretical Framework

Cross-border M&A represents a crucial mechanism for enterprises to integrate resources and shift comparative advantages around the globe. Neary (2007), based on the General Oligopolistic Equilibrium (GOLE) model, states that trade liberalization will prompt low-cost firms to acquire new comparative advantages through cross-border M&A, which are reflected in technological, capital, or market efficiency aspects, and thus achieve cross-border resource reallocation. This indicates that cross-border M&As are not merely a market expansion strategy but also a strategic tool for enterprises to proactively construct and enhance their comparative advantages in global competition.

Institutional economics regards institutions as “the game rules determining transaction costs” and institutional changes influence corporate behavior by altering access to information and compliance costs (Hirsch & Lounsbury, 1996). In the context of increasingly strict data regulation, the GDPR, as a typical external institutional shock, may influence the cost–benefit structure of firms’ cross-border M&A decisions by increasing data compliance costs and institutional frictions. This mechanism is mainly reflected in the following three aspects.

First, the GDPR significantly increases firms’ data compliance costs (Prasad, 2020). Under this institutional framework, firms must comply with strict legal requirements in data collection, processing, storage, and usage (Prasad, 2020). Existing research indicates that medium-sized firms spent nearly $3 million to meet GDPR compliance requirements, while the costs for large firms were even higher (Prasad, 2020). Some small and medium-sized enterprises even exited the EU market because they could not afford the compliance costs (Prasad, 2020). Therefore, higher compliance costs may raise both the pre-acquisition evaluation costs and the post-acquisition integration costs of cross-border M&A, reducing the attractiveness of cross-border M&A.

Second, the GDPR may reduce the data availability of firms by restricting data collection and use (Prasad, 2020). Since data collection requires the explicit consent of users, the amount of data firms can obtain declines significantly (Prasad, 2020). For instance, after the implementation of the GDPR, data tracking in some industries decreased by about 12.5% (Prasad, 2020). This may weaken firms’ ability to access information about target markets and increase information asymmetry, thereby raising transaction costs in M&A strategy.

Third, the GDPR strengthens the regulation of data sharing and increases the risk of non-compliance (Prasad, 2020). Firms face higher legal liability when sharing data with third parties, with potential fines of up to €20 million or 4% of global revenue (Prasad, 2020). Consequently, firms tend to reduce collaborations involving third-party data and increasingly rely on large platforms with stronger compliance capabilities, which leads to an approximately 17% increase in market concentration (Prasad, 2020). This change may not only raise institutional frictions but may also affect the structure of the M&A market.

In addition, the GDPR may suppress investment by increasing institutional uncertainty (Prasad, 2020). Empirical evidence shows that after the GDPR implementation, venture capital transactions in the EU decreased by about 26.1%, while the amount of financing decreased by approximately 33.8% (Prasad, 2020). Foreign investment was also significantly affected (Prasad, 2020). This suggests that heightened institutional uncertainty may reduce the willingness of firms to engage in cross-border M&A.

Peng et al. (2008) maintain that firms could mitigate the uncertainty generated by institutional changes through various means, such as adjusting organizational structures and data governance practices. Xu et al. (2024), based on the technology-institutional cohesion model, further demonstrate that institutional adaptability improves organizational innovation and learning, which significantly enhances sustainable growth within regulatory environments. This implies that firms do not passively exit the market under institutional shocks, but instead they might reduce institutional frictions through innovations in compliance and data localization, which assist them in forming new comparative advantages in the process. This argument entails that institutional shocks not only pose external constraints but also provide opportunities for firms to develop “new comparative advantages” by adaptive responses. This perspective is further reinforced by the “New OLI Framework” proposed by Luo (2021) within the context of digital globalization. Luo (2021) suggests that locational advantages (L) in the digital economy era are no longer determined solely by market size and factor costs, and that data accessibility and regulatory transparency are also critical factors influencing corporate internationalization strategies. As data becomes a key factor of production, institutional differences increasingly influence corporate decision-making.

Based on the above analysis, this study constructs a unified theoretical framework. In this framework, the GDPR, as an external institutional shock, affects the strategies of firms by increasing compliance costs and institutional frictions. Firms make choices between “adaptation” and “exit” based on their own institutional adaptability. Such choices may influence their cross-border M&A behavior and further affect the reconstruction of comparative advantage. Therefore, the impact of the GDPR on cross-border M&A is not simply a one-way inhibitory effect, but depends on the interaction between institutional friction and the adaptive capacity of firms.

Based on this theoretical framework, this study proposes the following testable hypotheses:

Hypothesis 1. 

By increasing data compliance costs and institutional frictions, the GDPR has an overall inhibitory effect on the cross-border M&A activities of Chinese digital firms in the EU.

Hypothesis 2. 

Firms’ institutional adaptation capabilities can mitigate the negative effects of the GDPR. Consequently, among firms with stronger adaptation capabilities, the inhibitory effect of the GDPR on cross-border M&A is weaker.

To summarize, this study integrates insights from comparative advantage theory and institutional adaptation theory to propose a unified analytical framework of “institutional shock → institutional friction → firm response → M&A decision → comparative advantage restructuring.” This framework not only explains the mechanisms through which the GDPR may suppress cross-border M&A but also highlights the critical moderating role of firms’ adaptive behaviors. Therefore, the actual effects of institutional shocks need to be examined empirically.

3. Literature Review

3.1. Comparative Advantage and Cross-Border M&A

The early foundations of international trade theory, particularly David Ricardo’s comparative advantage framework, emphasize that trade occurs when countries specialize according to differences in opportunity costs, leading to mutually beneficial exchange (Schumacher, 2012; Rahman, 2023). While Ricardo’s insights highlight how relative cost differences shape trade patterns, this classical perspective treats the nation-state as the primary unit of analysis and assumes that comparative advantage arises from exogenous factors. However, the classical theory of comparative advantage provides little explanation for how firms proactively construct competitive advantages in global markets.

Within the framework of foreign direct investment (FDI), firms face a choice between greenfield investment and cross-border M&A as entry modes (Gilroy & Lukas, 2006). These two entry modes differ significantly in terms of cost structure, entry speed, and flexibility (Gilroy & Lukas, 2006). In highly uncertain environments, cross-border M&A has distinct advantages because it enables firms to directly acquire existing technologies, market networks, and organizational capabilities, thereby facilitating rapid entry into host-country markets (Gilroy & Lukas, 2006). In contrast, greenfield investment usually involves a longer construction period and higher sunk costs (Gilroy & Lukas, 2006). Research based on Chinese firms’ data shows that cross-border M&A can generate more pronounced short-term market responses and exhibits superior performance in the long run, indicating significant value-creation effects (An, 2009). These findings suggest that cross-border M&A is not merely a mode of entry but also a strategic decision through which firms improve efficiency and access multinational resources.

Since different entry modes differ fundamentally in their cost structures, adjustment mechanisms, and responses to uncertainty, treating FDI as a homogeneous whole may hide important mechanisms of firm behavior. Therefore, focusing on cross-border M&A is crucial for understanding how firms respond to institutional shocks and make strategic multinational investment decisions. Beyond its role as a mode of entry, cross-border M&A also contributes to the reshaping of firms’ competitive advantage. Therefore, it is also necessary to further understand the role of cross-border M&A in firms’ internationalization strategies from the perspective of comparative advantage.

Studies over subsequent periods move from the national level to the corporate level to explore how firms reshape global competitive advantages through cross-border M&A. Neary (2007), in the General Oligopolistic Equilibrium (GOLE) model, proposes that trade liberalization prompts low-cost firms to restructure industrial operations through cross-border M&A, thereby strengthening comparative advantages on the international level. Later, Brakman et al. (2005) validate the model proposed by Neary with multi-country empirical data and find that cross-border M&A flows are significantly correlated with the Revealed Comparative Advantage (RCA) of a nation. They also find that cross-border M&A activity occurs in distinct waves, and that these surges tend to align with countries’ underlying comparative advantages, suggesting that firms use M&A strategically to extend and reinforce national comparative advantages at the corporate level.

Although existing studies have extensively explored the relationship between comparative advantage and cross-border M&A, most of this research focuses on traditional industries and largely overlooks the challenges and opportunities faced by firms in the digital economy (Neary, 2007; Brakman et al., 2005). Moreover, while some literature emphasizes the link between cross-border M&A and comparative advantage, research on the behavior of digital firms in cross-border M&A remains limited, especially regarding digital governance and compliance challenges.

This study addresses this gap by integrating insights from comparative advantage and institutional adaptation. It examines how digital firms proactively enhance their comparative advantage through cross-border M&A under external regulatory shocks. This contribution not only extends the application of comparative advantage theory but also provides a new analytical perspective on firm expansion strategies in the digital economy era.

3.2. Determinants of Cross-Border M&As

Traditional research on the drivers of cross-border M&As suggests that the occurrence of these transactions is influenced by various macroeconomic and institutional factors. The empirical evidence from Erel et al. (2012) indicates that geographical closeness and a high-quality institutional environment reduce information asymmetry and integration risks, while institutional constraints and regulatory barriers increase cross-border transaction costs. Moreover, Ahern et al. (2015) also mention that excessive cultural distance increases communication barriers and integration costs, resulting in weakened synergies.

Additionally, the traditional OLI framework proposed by Dunning (2000) summarizes the drivers of cross-border investment into three categories systematically—ownership advantages, location advantages, and internalization advantages. This framework provides the theoretical foundation for the subsequent analysis incorporating institutional differences and strategic adaptation. Compared to analyses of macro-level drivers, the OLI framework emphasizes resource allocation and governance choices more on the corporate level (Dunning, 2000), which provides a new perspective for understanding mergers and acquisitions as corporate strategic behavior. Luo (2021) subsequently proposed a new OLI framework in the context of the digital economy, emphasizing that open resources (Open), network linkage (Linkage), and integration capability (Integration) have become new drivers of cross-border M&A activities in digital enterprises.

Existing literature on the determinants of cross-border M&A has largely focused on macroeconomic drivers, such as geographic distance, market size, and cultural environment, which are mainly applicable to traditional industries (Erel et al., 2012; Ahern et al., 2015). Although subsequent studies have suggested unique drivers of cross-border M&A in the digital economy, they have not fully examined or discussed the effects of stringent regulatory environments on the M&A behavior of digital firms (Dunning, 2000; Luo, 2021). Moreover, empirical research is still limited on how digital firms adjust their M&A strategies under global digital governance frameworks, for example, through innovations in data governance and compliance to address new regulatory challenges.

This study focuses on the impact of cross-border M&A under a strict regulatory environment and investigates the effects of the GDPR on the cross-border M&A activities of Chinese digital firms for the first time. This study further introduces a mechanism in which institutional adaptation enhances comparative advantage, highlighting how firms respond to entry barriers and institutional shocks by improving compliance and data governance capabilities. Through empirical analysis, while this study does not find a statistically significant inhibitory effect of the GDPR on the cross-border M&A behavior of Chinese digital firms in the short term, it provides new insights into the interaction between endogenous institutional adaptation and M&A behavior in the digital economy context.

3.3. GDPR and Its Impact at the Firm Level

3.3.1. The Impact of the GDPR on Data Collection, User Behavior, and Digital Advertising

Empirical findings by Congiu et al. (2022) indicate that the GDPR causes a roughly 15% decline in European website traffic and user engagement. This primarily manifests in shorter visit durations and increased bounce rates (Congiu et al., 2022). The extant literature also provides substantive evidence indicating that the GDPR significantly alters how businesses collect and utilize personal data. For instance, Aridor et al. (2023) find that after the GDPR implementation, opt-out rates increase by 12.5%, and the overall volume of third-party tracking declines significantly. This reduces the scale of data available on online platforms and delivers a short-term shock to advertising revenue (Aridor et al., 2023).

Meanwhile, the GDPR also impacts algorithmic predictive capabilities by weakening firms’ ability to conduct targeted advertising and user profiling. The study of Goldfarb and Tucker (2011) emphasizes that privacy regulations reduce the effectiveness of targeted advertising, thereby diminishing the efficiency of business models relying on data analytics. However, Aridor et al. (2023) present an insightful finding: although overall engagement levels decline, the behavior of remaining users demonstrates greater consistency, which enhances the predictability of residual data. This indicates that the impact of the GDPR on data structures is complex. Overall, the GDPR has altered the algorithmic capabilities and advertising revenue models of digital enterprises by reducing data availability and trackability.

3.3.2. The Impact of the GDPR on the Competitive Structure and Industry Dynamics of Digital Enterprises

Johnson et al. (2023) find that the GDPR disrupts web technology providers reliant on personal data, fundamentally altering the B2B data-sharing model. This causes websites to prefer retaining top providers like Google and Facebook, leading to a significant increase in market concentration among suppliers. Similarly, based on tracking data from over 110,000 websites, Peukert et al. (2022) find that the GDPR triggers a significant “Brussels Effect”. This means that non-EU websites also reduce third-party data interactions proactively, demonstrating the global spillover effects of the GDPR. However, the market share of large tech companies (such as Google) in advertising and analytics increases following GDPR implementation (Peukert et al., 2022). This suggests that privacy regulations may unintentionally reinforce digital monopolies, a pattern consistent with the findings of Zhao et al. (2021), who show that increased compliance costs and reduced advertising effectiveness push some SMEs out of the market, while large platforms consolidate their dominance by leveraging their superior resources and technological capabilities.

Overall, the GDPR exhibits a clear scale effect—by raising compliance costs and reshaping data-related competitive advantages, it increases market concentration in the digital economy and consequently weakens the competitiveness of small and medium-sized enterprises. For large platforms, their technological and organizational advantages help them to gain relative market share and profits in a privacy regulation environment. This conclusion is also consistent with the theoretical framework of this study, which focuses on digital firms facing a decline in comparative advantages under stringent regulatory environments and therefore having to enhance their institutional adaptability.

3.3.3. Impact of the GDPR on Cross-Border Operations and Multinational Strategies

Firstly, in terms of investment, Kircher and Forderer (2021) find that the GDPR not only affects EU companies but also generates institutional spillover effects in the US market. This effect reduces the funding probability for data-driven startups and increases their risk of closure. Jia et al. (2021) find that European technological venture investments decline by approximately 15–20% in the short term following GDPR implementation, particularly in data-intensive industries like AdTech and App services. Voss and Houser (2019) argue that GDPR compliance requires companies to redesign core data governance processes—including data mapping, classification, documentation, and monitoring—and to build comprehensive internal compliance frameworks aligned with EU standards. Due to the stringent penalties for violations under this regulation, the authors argue that the GDPR effectively forces multinational companies to adjust their organizational arrangements and global strategic planning (Voss & Houser, 2019). This drives multinational corporations to proactively enhance their institutional adaptability to address regulatory differences (Voss & Houser, 2019).

Although existing studies on the impact of the GDPR have mainly focused on firm-level data collection, investment volumes, and user behavior (Aridor et al., 2023; Congiu et al., 2022; Jia et al., 2021), these studies have primarily examined European and U.S. firms. There is limited research on how the GDPR affects the behavior of Chinese digital firms, particularly in the context of cross-border M&A.

Therefore, this study focuses on Chinese digital firms and investigates how the GDPR, as a policy shock, influences their cross-border M&A activities, thereby enriching the existing literature by addressing the lack of research on the GDPR’s effects on emerging-market firms and their cross-border M&A behavior.

3.4. Research Gap and Contribution

Existing literature has widely discussed cross-border M&A and the economic impact of the GDPR from different perspectives, but there is still a lack of systematic integration and a unified analytical framework connecting these three areas.

First, comparative advantage theory has gradually expanded from the country level to the firm level, emphasizing that cross-border M&A serves as an important tool for firms to reconstruct and strengthen their competitive advantages (Neary, 2007; Brakman et al., 2005). However, most of these studies are based on traditional industries (Neary, 2007; Brakman et al., 2005) and pay limited attention to how institutional factors, such as data regulation and privacy protection in the digital economy, act as constraints that influence firms’ ability to reconstruct comparative advantage through M&A.

Second, research on the determinants of cross-border M&A indicates that macroeconomic conditions, institutional environments, and cultural differences significantly affect firms’ M&A decisions by affecting transaction costs and information asymmetry (Erel et al., 2012; Ahern et al., 2015). Although subsequent studies have introduced the OLI framework and its extensions in the digital economy to explain firm-level drivers of cross-border M&A (Dunning, 2000; Luo, 2021), most of the literature still primarily focuses on traditional institutional differences or general regulatory environments. There is still a lack of systematic analysis of how firms make strategic adjustments under strict digital regulatory shocks, such as the GDPR, especially how they respond to external constraints through institutional adaptation.

Finally, much research on the GDPR mainly focuses on its effects on firm-level data collection, user behavior, and market structure (Aridor et al., 2023; Congiu et al., 2022; Jia et al., 2021). However, these studies mostly discuss operational-level adjustments and provide limited empirical evidence on how the GDPR affects strategic-level decisions of firms, especially cross-border M&A, which involves both control acquisition and resource integration. Moreover, existing studies are mainly based on European and U.S. firms (Aridor et al., 2023; Congiu et al., 2022; Jia et al., 2021), and there is a lack of systematic analysis of how Chinese digital firms adjust their behavior under the framework of global digital governance.

Therefore, existing literature has not yet systematically examined digital regulatory shocks, cross-border M&A, and firms’ institutional adaptation mechanisms within a unified framework. Based on this gap, this study treats the GDPR as an exogenous institutional shock and integrates comparative advantage and institutional adaptation perspectives to examine the cross-border M&A behavior of Chinese digital firms under stringent data regulation and its underlying mechanisms. This approach provides new empirical evidence and theoretical insights into how firms reconstruct competitive advantages within the global regulatory environment of the digital economy.

4. Data

The data for this study were mainly obtained from the SDC database. The sample contains cross-border M&A events involving Chinese firms in the “Internet and Catalog” sector, with a time span from 2014 to 2021 and a total of 678 observations (Refinitiv, 2024). This category includes typical digital economy enterprises such as software services, information processing, and online platforms, as well as some high-tech manufacturing and professional services (Refinitiv, 2024). The core data involve the number of M&A events. The study applies panel data to simultaneously identify time effects and country-characteristic differences.

This study initially collected 1778 firm-level cross-border M&A activities from the SDC database (Refinitiv, 2024). Since SDC records deals at the firm level, but the empirical analysis in this study requires identifying the net effect of the GDPR at the country–year level, all M&A events are aggregated by host country and year to construct the total value of Chinese M&A activities in each period. After aggregation, the M&A data are matched with macroeconomic datasets such as WDI and CEPII. During this matching process, some countries or years are excluded due to certain missing macroeconomic variables. The final regression dataset contains 678 country–year observations. It is important to note that data cleaning and matching mainly affect the number of observations in the panel dataset and do not change the industry classification of firms. Therefore, the industry distribution is still based on the original 1778 cross-border M&A actives, which better reflects the actual industrial structure of the sample.

Several control variables are included, including macro-level indicators such as GDP, economic growth rate, exchange rate, geographic distance, bilateral trade value, common language, and religion. These data are obtained from CEPII (2024) and the World Bank (2024). These variables are widely utilized in multinational merger and acquisition studies to control for economic scale and institutional cultural differences (Erel et al., 2012; Ahern et al., 2015).

The firm sample used in this study comes from the Internet and Catalog section in the SDC Platinum database (Refinitiv, 2024). This industry category encompasses a broad range of sectors, including enterprises in the digital economy such as software services, online platforms, and information processing. It also covers technology-related manufacturing and professional services (Refinitiv, 2024). Because this study focuses on the cross-border M&A activities of Chinese digital-economy firms in the EU market, and because the impact of the GDPR is international in nature, it is necessary to adopt an internationally comparable classification system for industry definitions. This study systematically converts the original SIC (Standard Industrial Classification) codes provided by SDC into ISIC Rev.4 (International Standard Industrial Classification) based on the SIC–ISIC Correspondence Table published by Statistics South Africa (Stats SA, 2025). This ensures that industry definitions align with official statistical standards, thereby enhancing the comparability and explanatory power of the analysis.

Based on the business attributes of the SIC codes and the correspondence table, the original sample is grouped into industries.

Table A3. Industry classification.

Industry Category	Corresponding ISIC Range	Number of Observations	Share (%)
ICT and Digital Services	ISIC 58, 61, 62, 63, etc.	566	31.8%
High-tech Manufacturing	ISIC 26, 28	7	0.4%
Other Professional and Related Services	ISIC70-71, 5911-5912, etc.	1205	67.8%
Total		1778	100%

Note: This table reports the industry distribution based on the original sample (1778 observations). Industry categories are constructed by mapping SIC codes to ISIC Rev.4 using the UN correspondence tables. Industry attributes are determined prior to data cleaning; therefore, classification follows the raw dataset.

in Appendix C shows the industry distribution and classification results. About 31.8% of the firms belong to the ICT and digital services sector (ISIC 582, 61, 62, 63). This group mainly includes software publishing (e.g., SIC 7371 and 7372), system design and integration services (7373), information retrieval and data processing (7375), computer and IT services (7379), as well as some communication service firms (e.g., SIC 4899 and 4812). These industries are highly data-intensive and are the most directly affected by the GDPR.

In addition, around 0.4% of the firms are classified as high-technology manufacturing (ISIC 26 and 28), which includes companies producing electronic instruments and communication equipment (e.g., SIC 3585, 3825, 3661). Their technological structures are closely interlinked with the ICT industry chain and hold crucial positions within the data economy infrastructure.

The remaining 67.8% of the firms are classified into other professional services and related industries (ISIC 70–71, 5911–5912, 6499), including engineering and management consulting (SIC 8711, 8748), film and video production (7812, 7819), and financial investment companies (6726). Although these sectors are not strictly digital enterprises, their business activities rely substantially on digital technologies and are therefore included in the “Internet and Catalog Retailing” category by SDC. This study maintains this classification to reflect the actual industry composition of the sample and the broader characteristics of the digital economy.

Since the GDPR is uniformly implemented across EU member states, its policy shock operates at the country–year level rather than varying across industries. Therefore, industry classification does not affect the definition of treatment and control groups in the DID framework nor does it introduce exogenous variation into the policy variable. However, differences in data dependence across industries may generate heterogeneous responses to the GDPR. Accordingly, industry classification in this study is primarily used to support descriptive analysis and mechanism interpretation, rather than to construct treatment groups or identify policy effects. By reclassifying firms based on ISIC codes, this study ensures international comparability of industry definitions and provides a consistent foundation for subsequent analysis.

Table 1. Variable definitions and data sources.

Variables	Variable Definition	Data Source
lnMA	Log of the number of China–EU computer industry M&A deals (ln (1 + number of deals)).	SDC database (Security Data Corporation), industry category “Internet and Catalog Retailing”
SMA	Transaction value of China–EU digital industry M&A (paired with lnMA to handle zero-value cases).	SDC database
EU_Post	DID key variable—EU_Post denotes the interaction term between the EU dummy and the Post dummy variables.
EU	Dummy for EU countries (1 = EU member state; 0 = non-EU)
ln_pGDP	Log of host country GDP per capita (constant 2010 USD)	WDI
real_exchange	Real exchange rate (annual average, CPI adjusted).	WDI
lndis	Log of distance between China and the host country’s capital (km).	CEPII database
lntrade	Log of bilateral trade value between China and the host country (USD).	CEPII database
comlang_off	Common official-language dummy (1 = shared official language; 0 = otherwise).	CEPII, language proximity index.
comrelig	Common-religion dummy (1 = same main religion; 0 = different).	CEPII database

Note: All variables are defined at the country–year level. Data for China–EU M&A are sourced from SDC; macroeconomic variables are from the WDI and CEPII databases.

presents the definitions and data sources for key variables. The dependent variable measures the M&A activities of Chinese digital enterprises in host countries. lnMA denotes the logarithm of the number of M&A transactions, as the logarithmic transformation reduces the impact of extreme values and eases coefficient interpretation. The variable SMA represents the value of M&A transactions, which is utilized for robustness testing.

The key explanatory variable is EU_Post, a DID interaction term between the EU dummy variable and the year following GDPR implementation, to identify the net policy effect. The control variables mainly include host country GDP per capita, real exchange rate, bilateral trade volume, geographic distance and sociocultural similarity indicators.

Table 2. Descriptive statistics.

Variable	Observation	Mean	Std. Dev.	Min	Max
Y variables
lnMA	678	0.04	0.18	0.00	1.39
SMA	678	41.69	138.53	1.00	1054.00
X variables
EU	678	0.09	0.29	0.00	1.00
EU_Post	678	0.05	0.22	0	1
post	678	0.577	0.50	0	1
Control variables
ln_pGDP	678	8.70	1.43	5.93	11.39
real_exchange	678	4.09	2.86	−1.03	10.59
lndis	678	8.94	0.59	6.86	9.86
lntrade	678	15.09	1.98	9.47	20.26
comlang_off	678	0.03	0.17	0.00	1.00
comrelig	678	0.01	0.01	0.00	0.02

Note: The sample includes 678 observations from 2014 to 2021, covering China’s cross-border M&A in EU and non-EU countries. All variables are defined at the country–year level. lnMA and SMA represent the number and transaction value of M&A, respectively. EU_Post is the DID interaction term indicating the post-GDPR treatment effect. Control variables are sourced from the WDI and CEPII databases.

reports the descriptive statistics for the main variables. The mean of lnMA is relatively low, indicating that cross-border M&A events are quite sparse. In addition, the large standard deviation of SMA shows that the value of M&A deals varies significantly across countries. The mean and fluctuation range of the control variables align with macroeconomic indicators, demonstrating a reasonable data distribution without obvious abnormal values. These results suggest that the data structure is reasonable and provide a reliable foundation for the subsequent econometric analysis.

5. Methodology

5.1. Econometric Methods

In economic analysis, exogenous factors are typically defined as external shocks originating outside the economic system under study, which can affect economic outcomes without being influenced by the behavior of individual firms (Hans, 2023). In other words, when government regulation or intervention is implemented unilaterally and beyond the control of individual firms, such policies are considered exogenous policy shocks. The GDPR has been uniformly implemented across all EU member states since 2018, requiring firms to comply with a common regulatory framework (Wolford, 2025). Because the timing and scope of this policy were determined by EU regulatory authorities rather than driven by firm-level investment behavior, individual firms have neither the ability to influence the introduction of the policy nor the capacity to evade compliance requirements. In addition, the DID model has been widely applied to evaluate the economic outcomes of exogenous policy shocks (Bertrand et al., 2004). It can effectively isolate co-variation caused by other macro non-policy factors (potential for addressing endogeneity issues) while controlling for time trends and individual variability, thus identifying the net effect of the policy (Bertrand et al., 2004). Furthermore, existing studies also commonly treat the GDPR as an external regulatory shock suitable for quasi-natural experiment analyses. For example, Jia et al. (2021) adopt a difference-in-differences (DID) approach to identify the effects of the GDPR on venture investment activities. Following this approach, the study similarly treats the implementation of the GDPR as an externally imposed institutional change and constructs a DID model to identify the impact of the GDPR on the cross-border M&A activities of Chinese digital firms in the EU.

Following Jia et al. (2021), this study sets EU countries as the Treatment Group (EU = 1) and non-EU countries as the control group (EU = 0). A policy dummy variable, Post, is constructed to capture the formal implementation of the GDPR, taking the value of 1 for years t ≥ 2018. The DID identification relies on the differences in the trends of national M&A activities before and after the policy:

(EU_Post − EU Pre) − (Non-EU_Post − Non-EU Pre)

After controlling for country-specific long-term differences and year-level macroeconomic shocks, the DID design shown above allows for a more accurate estimation of the net policy effect and strengthens the credibility of the causal inference.

This study primarily focuses on the volume of mergers and acquisitions (M&A) conducted by Chinese digital enterprises in host countries. Therefore, the main dependent variable is the number of M&A events at the country–year level. The baseline model is specified as follows:

$$lnM{A}_{it}=\beta \left(E{U}_{it}\times Pos{t}_{it}\right)+\gamma X_{it}+{\lambda }_i+{\lambda }_t+{\epsilon }_{it}$$

In this model, $lnM{A}_{it}$ represents the logarithm of the number of mergers and acquisitions by Chinese digital enterprises in country i and year t. The interaction term ($EU\times Post$) is the core variable of the DID model. The interaction term EU_Post is used to identify changes in the cross-border M&A activities of Chinese digital firms in EU target markets following the implementation of the GDPR. Its coefficient, β, measures the relative change in Chinese firms’ M&A activities in EU target markets after the GDPR implementation, controlling for year and country fixed effects. In other words, this interaction term does not reflect the absolute changes in the EU market itself but captures the net policy effect of the GDPR on EU target markets relative to non-EU target markets. $X_{it}$ represents a set of control variables, including GDP per capita, exchange rate and measures of geographical and cultural distance, to capture the influence of various disruptive factors that may impact cross-border M&A activities. The inclusion of control variables helps reduce potential biases caused by macroeconomic conditions, market size, and country-specific differences.

${\lambda }_i \mathrm{a}\mathrm{n}\mathrm{d} {\lambda }_t$ denote the fixed effects of country and year, respectively. ${\lambda }_i$ represents country fixed effects, which control for unobserved, time-invariant characteristics of host countries, such as long-standing institutional environments, cultural distance, and geographic location. While these factors may influence Chinese firms’ cross-border M&A decisions, they typically do not change significantly in the short term. By controlling for country fixed effects, the model reduces estimation bias caused by long-term structural differences across countries. In addition, ${\lambda }_t$ represents year fixed effects, which are used to control for macroeconomic shocks that are common to all countries in the same year, such as global economic cycles and changes in the investment environment. Including year fixed effects allows the model to remove the influence of global common time trends on M&A activities, thereby focusing the identification strategy on the relative institutional shock induced by the GDPR. Finally, ${\epsilon }_{it}$ is the error term.

By including both country and year fixed effects, the individual effects of $E{U}_i$, which do not vary over time, are absorbed by the country fixed effects, while $Pos{t}_t$, which takes the same value across all countries each year, is absorbed by the year fixed effects. Therefore, the model includes only the interaction term $\beta (EU\times Post)$, which avoids collinearity with the fixed effects. β is the key parameter for identifying the effect of the GDPR.

In addition, to address potential serial correlation and heteroskedasticity, this study clusters the error terms at the country level. Given that the data constitute a country–year panel, the error terms for the same country across different years may exhibit arbitrary forms of correlation and heteroskedasticity. If these issues are not properly addressed, the standard errors may be underestimated (Bertrand et al., 2004).

Table A1. Country-level clustered standard errors in baseline DID Models.

Variables	(1) lnMA	(2) lnMA	(3) lnMA	(4) lnMA	(5) lnMA	(6) lnMA	(7) lnMA	(8) lnMA
EU_Post	0.0041	0.0041	0.0041	0.0041	0.0023	0.0023	0.0023	0.0023
	(0.049)	(0.010)	(0.049)	(0.011)	(0.043)	(0.010)	(0.043)	(0.010)
EU	−0.0451	−0.0451 **	−0.0451	−0.0451 **	−0.0483	−0.0483 **	−0.0478	−0.0478 **
	(0.037)	(0.017)	(0.037)	(0.017)	(0.034)	(0.019)	(0.034)	(0.019)
post	−0.0041	−0.0041	0.0026	0.0026	−0.0100	−0.0100	−0.0052	−0.0052
	(0.015)	(0.010)	(0.026)	(0.017)	(0.013)	(0.011)	(0.024)	(0.018)
ln_pGDP					0.0014	0.0014	0.0013	0.0013
					(0.006)	(0.011)	(0.006)	(0.011)
real_exchange					0.0013	0.0013	0.0014	0.0014
					(0.003)	(0.003)	(0.003)	(0.003)
lndis					−0.0310 **	−0.0310 *	−0.0306 **	−0.0306 *
					(0.012)	(0.018)	(0.012)	(0.018)
lntrade					0.0220 ***	0.0220 ***	0.0223 ***	0.0223 ***
					(0.004)	(0.008)	(0.004)	(0.008)
comlang_off					0.2710 ***	0.2710	0.2710 ***	0.2710
					(0.039)	(0.164)	(0.039)	(0.164)
comrelig					−2.1189 ***	−2.1189 *	−2.1164 ***	−2.1164 *
					(0.795)	(1.081)	(0.794)	(1.081)
Constant	0.0451 ***	0.0451 **	0.0441 **	0.0441 **	−0.0202	−0.0202	−0.0287	−0.0287
	(0.011)	(0.017)	(0.019)	(0.022)	(0.154)	(0.212)	(0.154)	(0.217)
Observations	678	678	678	678	678	678	678	678
R-squared	0.005	0.005	0.012	0.012	0.217	0.217	0.225	0.225
Year FE	No	No	Yes	Yes	No	No	Yes	Yes
Cluster	No	Yes	No	Yes	No	Yes	No	Yes

Standard errors in parentheses. *** p < 0.01, ** p < 0.05, * p < 0.1. Note: This table reports the robustness results of the main DID specification under different fixed effects and standard error clustering settings. The dependent variable (lnMA) measures the logarithm of the number of cross-border M&A deals conducted by Chinese digital enterprises in host countries. Columns (1) and (2) present specifications without and with country-level clustered standard errors, respectively, but without year fixed effects. Columns (3) and (4) include year fixed effects, with column (4) additionally clustering at the country level. Columns (5)–(8) report corresponding specifications for the two-way fixed effects model, including both country and year fixed effects, with and without clustering. The interaction term EU_Post captures the post-GDPR treatment effect for EU target markets. Across all specifications, the EU_Post coefficient remains small (0.0023–0.0041) and statistically insignificant, and clustering the standard errors at the country level adjusts for potential correlation of residuals within the same country over time. The stability of the coefficient across specifications and the use of clustered standard errors provide confidence that the main estimates are robust to serial correlation and heteroskedasticity.

in Appendix A reports the estimated results and standard errors for the core variable $EU\times Post$ under different fixed-effect specifications. Specifically, in the baseline model controlling only for year fixed effects without clustering, the coefficient of $EU\times Post$ is 0.0041 with a standard error of 0.0049. After clustering at the country level, the standard error increases to 0.010, while the coefficient remains in the same direction. When both year fixed effects and country-level clustering are applied, the coefficient of $EU\times Post$ remains between 0.0023 and 0.0041, with a standard error of 0.010. This indicates that the estimation results are robust and not sensitive to the fixed-effect specification.

The sample consists of 678 country–year observations, and cross-border M&A events are relatively low-frequency and highly volatile (with R² of lnMA ranging from 0.005 to 0.225). Clustering at the country level effectively mitigates bias arising from serial correlation and heteroskedasticity. In summary, clustering standard errors at the country level appropriately accounts for cross-year error correlation and heteroskedasticity, thereby enhancing the reliability of statistical inference.

5.2. Identification Strategy

To support the validity of the DID identification strategy, the following section provides further discussion on the choice of the control group and potential identification challenges.

To ensure the validity of the identification strategy, it is necessary to justify the use of non-EU countries as a control group. As a uniformly implemented data protection regulatory framework, the GDPR imposes compliance requirements on firms entering or operating in EU markets, representing the primary institutional shock (Presidente & Frey, 2022). For Chinese firms targeting EU markets, GDPR implementation increases data compliance costs, which may affect their cross-border M&A decisions (Presidente & Frey, 2022). In contrast, when Chinese firms engage in M&A in non-EU countries, while they may be influenced by the global diffusion of digital governance, they generally do not experience the same level of direct and strict regulation as in the EU (Wolford, 2025). Therefore, non-EU host countries can serve as a relatively reasonable control group to capture the potential trends in Chinese digital firms’ cross-border M&A activities in the absence of a direct GDPR regulatory shock.

In the identification process, it is also necessary to consider the timing of the policy and potential confounding factors. The GDPR was uniformly implemented across EU markets in 2018 (Wolford, 2025), and its introduction was highly exogenous, making it unlikely to be affected by firms’ M&A decisions (Hans, 2023). This provides a relatively clear basis for causal identification.

When Chinese firms conduct M&A in international markets, investment decisions are typically jointly driven by multiple macroeconomic factors (Erel et al., 2012; Ahern et al., 2015). Although institutional environments differ between EU and non-EU countries, to mitigate potential bias, the baseline regressions include controls for economic size, geographic distance, and trade intensity. Additionally, the model employs two-way fixed effects to account for unobserved country heterogeneity and time shocks. These measures help reduce systematic differences across groups and enhance comparability between treatment and control groups.

Furthermore, to strengthen the robustness of the results, the study conducts alternative variable specifications and sample adjustments to verify the consistency of the main findings. The analysis also considers that the EU implemented an FDI screening mechanism in 2019, which may have further affected Chinese firms’ M&A activities in EU markets (European Union, 2019). Robustness tests are conducted by adjusting the sample window, specifically excluding observations from 2019 onward to reduce potential interference from overlapping policies. The results indicate that the main conclusions remain consistent under this setting. However, it is difficult to fully rule out the influence of other concurrent policies or global shocks, and the potential identification issues arising from multiple overlapping policies are further discussed in the limitations section.

5.3. Identification of Hypotheses and Parallel Trends Tests

The Difference-in-Differences (DID) approach requires that the target variables of the treatment and control groups satisfy the parallel trends assumption before the policy implementation (Card & Krueger, 1994; Bertrand et al., 2004). In other words, the M&A trends between EU and non-EU countries should be consistent before GDPR implementation.

Under the event-study framework, to further examine the dynamics around the policy shock, a set of relative-year dummy variables is added to the baseline model to illustrate the effects in the years before and after the GDPR took effect. Figure A1 in Appendix B reports the estimated coefficients and their 95% confidence intervals. The figure shows that, in the pre-policy periods as well as in the implementation year (the current period), the coefficients for the pre-policy years are close to 0, their confidence intervals include 0, and no systematic trend deviation has occurred. This suggests that there is no significant trend toward differentiation, which supports the parallel trends hypothesis between the treatment group and the control group before GDPR implementation.

Furthermore, this study conducts a joint significance test on the pre-policy coefficients to assess the validity of the parallel trends assumption.

Table A2. Parallel trend joint test.

Test	F-Statistic	p-Value
pre_3 = pre_2 = 0	0.13	0.8795

in Appendix B shows that the joint test for pre_3 and pre_2 reports an F-statistic of 0.13, with a corresponding p-value of 0.8795. The result is not significant at conventional significance levels, meaning that the null hypothesis that the pre-policy coefficients are jointly equal to zero cannot be rejected. This result further suggests that, before the implementation of the GDPR, there was no systematic difference in pre-trends between the treatment group and the control group, thereby providing statistical support for the DID identification strategy.

After the policy implementation, although some post-period coefficients display slight fluctuations, they are not statistically significant overall and do not exhibit a sustained one-directional pattern. This further indicates that the GDPR has not triggered any significant structural deviation from established trends.

It should be noted that the confidence intervals for some periods are relatively wide. This may reflect the low frequency and high volatility of cross-border M&A events, which reduce statistical power in dynamic estimation. However, the pre-policy coefficients do not show systematic deviations, and the joint test does not indicate significant pre-trend differences. Therefore, the results support the parallel trends assumption and confirm the validity of the DID identification strategy.

6. Results

6.1. Main Results

Table 3. Pooled and one-way fixed effects estimates of models of M&A activities.

Variables	(1)	(2)	(3)	(4)
	Model 1	Model 2	Model 3	Model 4
	lnMA	lnMA	lnMA	lnMA
EU_Post	0.0041	0.0041	0.0023	0.0023
	(0.010)	(0.011)	(0.010)	(0.010)
EU	−0.0451 **	−0.0451 **	−0.0483 **	−0.0478 **
	(0.017)	(0.017)	(0.019)	(0.019)
post	−0.0041	0.0026	−0.0100	−0.0052
	(0.010)	(0.017)	(0.011)	(0.018)
ln_pGDP			0.0014	0.0013
			(0.011)	(0.011)
real_exchange			0.0013	0.0014
			(0.003)	(0.003)
lndis			−0.0310 *	−0.0306 *
			(0.018)	(0.018)
lntrade			0.0220 ***	0.0223 ***
			(0.008)	(0.008)
comlang_off			0.2710	0.2710
			(0.164)	(0.164)
comrelig			−2.1189 *	−2.1164 *
			(1.081)	(1.081)
Constant	0.0451 **	0.0441 **	−0.0202	−0.0287
	(0.017)	(0.022)	(0.212)	(0.217)
Observations	678	678	678	678
R-squared	0.005	0.012	0.217	0.225
Year FE	No	Yes	No	Yes

Robust standard errors in parentheses. *** p < 0.01, ** p < 0.05, * p < 0.1. Note: This table reports the pooled OLS and one-way fixed effects (year FE) estimates of the Difference-in-Differences (DID) specification examining the effect of the GDPR on Chinese digital firms’ cross-border M&A in the EU. The dependent variable (lnMA) is the logarithm of the number of M&A deals between China and EU countries. The key variable EU_Post captures the post-GDPR treatment effect. Columns (1) and (2) present baseline pooled and year fixed effects models, respectively. Columns (3) and (4) further include control variables such as economic size, exchange rates, bilateral trade intensity, geographic distance, and cultural proximity. Robust standard errors are clustered at the country level.

presents the DID estimation results combining OLS and one-way fixed effects (year fixed effects). Model 1 represents a baseline pooled regression model without any fixed effects. Model 2 extends the baseline by introducing year fixed effects. The third and fourth columns further incorporate control variables while retaining the specifications of the previous two models.

From the perspective of the core explanatory variable EU_Post in the DID model (i.e., the treatment effect following GDPR implementation), the coefficients for EU_Post in both models, that is, with and without the control variables, are positive but statistically insignificant. In the baseline pooled model (first column), the coefficient for the interaction term is 0.0041 and is not statistically significant. With the inclusion of the fixed effect for the year (second column), the coefficients remain broadly unchanged and still insignificant. The results remain stable even after further controlling for variables such as macroeconomic scale, bilateral trade, and cultural distance (Columns 3 and 4). These results suggest that we do not find statistically significant evidence that the GDPR inhibited the number of cross-border M&A deals by Chinese digital firms in the EU in the short term. The interaction term remains stable across different model specifications, suggesting that the estimated effect is not sensitive to time shocks or the inclusion of control variables. In addition, the scale of the estimated coefficients is relatively small. For example, the coefficient of EU_Post ranges from 0.0023 to 0.0041 across specifications, suggesting that the estimated short-term effect is also economically limited.

From a mechanism perspective, although the implementation of the GDPR increased data compliance costs, companies may respond to the policy shock through institutional adaptation measures like compliance system development and data localization. This pattern is also consistent with the institutional adaptation theory emphasized by Peng et al. (2008), which suggests that firms could reduce the direct impact of institutional shocks through organizational learning and structural adjustments.

Regarding the EU dummy variable, its coefficients are negative and statistically significant across all four models. This suggests that the EU market itself presents relatively higher entry barriers for Chinese digital enterprises, probably due to structural macro factors including cultural distance and strict regulatory requirements. This indicates that the GDPR may not be the only regulatory factor affecting the M&A activities of Chinese digital companies; structural barriers in the EU market also play an important role in the long term. However, it should be noted that this coefficient merely reflects structural differences between EU and non-EU countries and does not identify the causal effect of the GDPR.

Additionally, in terms of control variables, the coefficient of lntrade remains positive and statistically significant in the extended model, suggesting that closer trade relations are associated with higher levels of cross-border M&A activities. Close trade connections may reduce investment uncertainty through familiarity with institutional frameworks and the accumulation of business networks, subsequently facilitating cross-border capital flows. Other macroeconomic variables do not exhibit stable statistical significance overall. This result suggests that M&A decisions in the digital economy may be more strongly associated with market connectivity and industrial network structures rather than short-term macroeconomic fluctuations.

To strengthen the identification of policy effects,

Table 4. Two-way fixed effects estimates of models of M&A activities.

Variables	(1) Model 1 lnMA	(2) Model 2 lnMA
EU_Post	0.0044	0.0073
	(0.011)	(0.016)
ln_pGDP		−0.0206
		(0.085)
real_exchange		0.0048
		(0.008)
lntrade		−0.0013
		(0.008)
Constant	0.0385 ***	0.2182
	(0.001)	(0.726)
Observations	678	678
R-squared	0.474	0.474
Country FE	Yes	Yes
Year FE	Yes	Yes

Robust standard errors in parentheses. *** p < 0.01. Note: This table reports the two-way fixed effects DID estimates, including both country and year fixed effects. The dependent variable is lnMA. Due to the inclusion of country and year fixed effects, the EU and Post dummy variables are absorbed by the fixed effects structure, and only the interaction term EU_Post remains identifiable. Column (1) presents the baseline two-way fixed effects model, while Column (2) further includes control variables. Robust standard errors are clustered at the country level.

presents the results of a two-way fixed effects DID estimation (with country and year fixed effects). Under this specification, the two separate dummy variables EU and Post are absorbed by the country and year fixed effects, respectively, leaving only the interaction term EU_Post to identify the policy shock. The results indicate that in both two-way fixed-effects models with and without control variables, the coefficient of the interaction term remains positive but is not statistically significant. This is broadly consistent with the results reported in Table 3. In other words, even under the two-way fixed effects specification that more strictly controls for time-invariant country characteristics and common year shocks, the analysis still does not provide statistically significant evidence of a negative GDPR-related policy effect. This finding further supports the robustness of the main result. Moreover, the estimated coefficients remain small in magnitude across specifications, suggesting that any short-term effect of the GDPR on cross-border M&A activities is likely to be economically limited.

6.2. Robustness Test Results

To further validate the reliability of the baseline results, this study conducts the following supplementary tests according to the robustness testing framework proposed by Neumayer and Plümper (2017).

6.2.1. Sample Adjustment Test

To examine whether the results are sensitive to sample composition and time selection, this study first conducts a sample adjustment test. Since the UK did not fully comply with the GDPR policy after its withdrawal from the EU in 2020 (European Commission, 2020), the UK is excluded from the sample of EU member states to avoid potential distortion of the model estimates. In addition, the sample period is shortened to 2015–2020 to reduce noise in the earlier years and to examine whether the findings are sensitive to the chosen period.

Table A4. Robustness Test I: Sample adjustment (excluding the UK and shortening the sample period).

Variables	(1)	(2)	(3)
	rob 1	rob 2	rob 3
	lnMA	lnMA	lnMA
EU_Post	0.0109	0.0105	0.0142
	(0.019)	(0.018)	(0.022)
EU	−0.0519 **	−0.0537 **
	(0.021)	(0.024)
post	−0.0109	−0.0136
	(0.019)	(0.024)
ln_pGDP		0.0071	−0.0110
		(0.008)	(0.108)
real_exchange		0.0040	0.0149
		(0.003)	(0.021)
lndis		−0.0263
		(0.016)
lntrade		0.0215 ***	0.0006
		(0.007)	(0.015)
comlang_off		0.2501 *
		(0.147)
comrelig		−1.4914
		(0.900)
Constant	0.0519 **	−0.1124	0.0628
	(0.021)	(0.196)	(1.095)
Observations	484	484	484
R-squared	0.006	0.221	0.420
Country FE	No	No	Yes
Year FE	No	Yes	Yes

Robust standard errors in parentheses. *** p < 0.01, ** p < 0.05, * p < 0.1. Note: This table presents the robustness results after excluding the UK from the sample and shortening the study period to 2015–2020. The dependent variable (lnMA) measures the logarithm of the number of China–EU M&A deals. Column (1) presents the baseline specification without fixed effects, Column (2) includes year fixed effects and control variables, and Column (3) reports the two-way fixed effects model including both country and year fixed effects. EU_Post captures the post-GDPR treatment effect. Robust standard errors are clustered at the country level.

in Appendix D presents the first robustness test, which excludes the UK sample and shortens the sample period to 2015–2022. To ensure consistency in the identification framework between the robustness analysis and the baseline regressions, representative model specifications are selected for testing—specifically, a one-way fixed effects model with year fixed effects and control variables, as well as a two-way fixed effects model including both country and year fixed effects. All possible model combinations are not repeatedly reported.

The results suggest that after adjusting the sample and time, the estimated coefficient for the interaction term EU_Post remains positive but not statistically significant. In the one-way fixed effects model, the coefficient on EU_Post is about 0.0105; in the two-way fixed effects model, it is about 0.0142. The magnitude of these robustness estimates is broadly consistent with the baseline results, and none of them achieve statistical significance. These results suggest that the main findings are not sensitive to the exclusion of the UK sample or the choice of sample period. Consistent with the baseline results, we do not find statistically significant evidence of a GDPR-related inhibitory effect under these alternative specifications.

Furthermore, in the one-way fixed effects model, the estimated coefficient of EU remains negative and statistically significant. Under the two-way fixed effects specification, this variable is absorbed by the country fixed effects, which aligns with the specification logic in the main regression. This indicates that structural entry barriers in the EU market persist across different time periods and sample compositions. In other words, market entry barriers in the EU are long-term challenges for Chinese digital companies, rather than short-term policy shocks caused solely by the GDPR. Overall, the sample adjustment test does not contradict the core findings and further enhances the robustness of the results.

6.2.2. Dependent Variable Substitution Test

To further validate the robustness of the results, a dependent-variable substitution test was also conducted by replacing the number of M&A transactions (lnMA) with the total value of M&A deals (SMA). This examines whether the implementation of the GDPR influences decision-making at the scale level of M&A transactions.

Table A5. Robustness Test II: Alternative dependent variable (SMA—Total Transaction Value).

Variables	(1)	(2)	(3)
	rob 1	rob 2	rob 3
	SMA	SMA	SMA
EU_Post	−0.0677	−4.4060 *
	(0.392)	(2.357)
EU	−33.4280 **	−54.5983 ***
	(16.172)	(18.475)
post	0.0677	−5.7750 *
	(0.392)	(2.944)
ln_pGDP		9.5975 *
		(4.842)
real_exchange		−3.1438
		(2.850)
lndis		3.3070
		(21.013)
lntrade		24.3563 **
		(10.453)
comlang_off		297.1982
		(235.916)
comrelig		−2679.3167 ***
		(993.237)
Constant	44.7614 ***	−412.8262	41.6903
	(15.551)	(314.032)	(0.000)
Observations	678	678	678
R-squared	0.005	0.441	1.000
Country FE	No	No	Yes
Year FE	No	Yes	Yes

Robust standard errors in parentheses. *** p < 0.01, ** p < 0.05, * p < 0.1. Note: This table reports the robustness test using an alternative dependent variable (SMA), which measures the total transaction value of China–EU M&A deals. Column (1) presents the baseline specification without fixed effects, Column (2) includes year fixed effects and control variables, and Column (3) reports the two-way fixed effects model including both country and year fixed effects. EU_Post captures the post-GDPR treatment effect. Robust standard errors are clustered at the country level.

in Appendix D presents the estimation for the alternative dependent variable, which replaces the dependent variable with the value of M&A (SMA). Similarly, this study selects representative model specifications consistent with the baseline regressions for the robustness test. Across different model frameworks, the estimated coefficient of EU_Post is not statistically significant. For instance, in the model incorporating year fixed effects and control variables, the coefficient on the interaction term is −4.406.

The findings provide no statistically significant evidence that the implementation of the GDPR affected either the number or transaction size of M&A deals by Chinese digital enterprises in the EU. The estimated coefficients do not exhibit a statistically significant negative effect across specifications.

Meanwhile, the coefficient of EU remains negative and significant. This further suggests that structural barriers in the EU market may play a persistent role in shaping M&A activities by Chinese digital companies. The structural barriers in the EU market exhibit long-term stability rather than being driven by short-term policy effects triggered by the GDPR.

In summary, the results from both the sample adjustment test and the dependent variable substitution test show that the estimated interaction term (EU_Post) remains consistently statistically insignificant across different specifications, samples, and outcome measures. This consistency suggests that the baseline findings are not sensitive to alternative empirical settings. Importantly, these results should be interpreted as indicating that there is no statistically significant evidence of a short-term inhibitory effect of the GDPR on Chinese digital firms’ cross-border M&A activities in the EU, rather than conclusive evidence of no effect.

6.2.3. Excluding Post-2019 Observations

Considering that the EU further strengthened its FDI screening mechanism after the implementation of the GDPR (European Commission, 2025), this study conducts an additional robustness check to mitigate potential confounding effects from contemporaneous policy changes on the DID estimates. According to the European Commission report, the FDI screening mechanism particularly focuses on investments related to technology, critical infrastructure, and sensitive data. The ICT industry is also an important sector among reviewed transactions (European Commission, 2025). For Chinese digital firms, such investment security regulations may operate concurrently with the GDPR in EU target markets, potentially introducing confounding factors.

To address this, this study further removes observations after 2019 and retains only the 2014–2018 observations to re-estimate the model. The main purpose of this adjustment is to test whether the results of this study are mainly driven by the strengthening of the EU FDI screening mechanism after 2019 and other contemporaneous regulatory changes.

The regression results reported in

Table A6. Robustness Test III: Sample adjustment (excluding post-2019 observations).

Variables	(1)	(2)	(3)
	rob 1	rob 2	rob 3
	lnMA	lnMA	lnMA
EU_Post	−0.0359	−0.0329	−0.0359
	(0.030)	(0.022)	(0.030)
EU		−0.0471 *
		(0.024)
post		0.0284
		(0.029)
ln_pGDP	0.0757	0.0008	0.0757
	(0.240)	(0.013)	(0.240)
real_exchange	−0.0162	0.0003	−0.0162
	(0.031)	(0.005)	(0.031)
lndis		−0.0141
		(0.022)
lntrade	−0.0034	0.0316 ***	−0.0034
	(0.039)	(0.012)	(0.039)
comlang_off		0.2776
		(0.176)
comrelig		−2.0785
		(1.428)
Constant	−0.4961	−0.3079	−0.4961
	(1.853)	(0.319)	(1.853)
Observations	388	388	388
R-squared	0.591	0.237	0.591
Country FE	No	No	Yes
Year FE	No	Yes	Yes

Robust standard errors in parentheses. *** p < 0.01, * p < 0.1. Note: This table reports the robustness results after excluding post-2019 observations in order to mitigate the potential influence of concurrent regulatory developments, particularly the strengthening of the EU FDI screening framework after 2019. The dependent variable (lnMA) measures the logarithm of the number of cross-border M&A deals conducted by Chinese digital enterprises in host countries. Column (1) reports the pooled OLS specification without fixed effects. Column (2) includes year fixed effects and control variables. Column (3) presents the two-way fixed effects model including both country and year fixed effects. The interaction term EU_Post captures the post-GDPR treatment effect for EU target markets. Robust standard errors are clustered at the country level.

of Appendix D show that, after excluding post-2019 observations, the coefficient of the core interaction term EU_Post remains negative across three model specifications, with estimated values of −0.0359, −0.0329, and −0.0359, and none of them reach the level of statistical significance. Compared with the baseline results, the sign and magnitude of the core coefficient remain broadly consistent.

This result suggests that the statistically insignificant effect estimated in this study is not entirely driven by changes in the EU investment security screening mechanism after 2019. If the FDI screening mechanism were the primary factor affecting M&A activity in EU target markets, excluding post-2019 observations would have led to noticeable changes in the estimates. However, after excluding the potential interference of the post-2019 FDI screening policy, the main conclusion that the GDPR does not show a statistically significant inhibitory effect remains unchanged, thereby reinforcing the robustness of the findings.

However, since the GDPR was officially implemented in 2018, removing observations after 2019 significantly shortens the post-policy observation period. Consequently, this check cannot fully capture the long-term dynamic effects of the GDPR and may reduce statistical performance. This analysis is treated as a supplementary robustness test. Overall, the results suggest that the main findings are not primarily driven by the EU FDI screening mechanism post-2019, though it remains important to cautiously acknowledge that overlapping policies may still exert some influence on cross-border M&A activity.

6.2.4. Placebo Test (Fake Policy Year)

To further examine the reliability of the estimation results and rule out the possibility that the model is driven by other time-related factors, this study conducts a placebo test. Specifically, the fake policy implementation year is moved forward to 2016, and the DID model is re-estimated. If the estimated results are primarily driven by random fluctuations or other time trends, the fake policy variable may also exhibit significant effects. Conversely, if the institutional shock associated with GDPR implementation is the main source of the estimated effects, the fake policy variable should remain insignificant.

Table A7. Robustness test IV: Placebo test (fake policy year).

Variables	(1)	(2)	(3)
	lnMA	lnMA	lnMA
FakeEU_Post	0.0015	−0.0015	0.0044
	(0.016)	(0.015)	(0.021)
EU	−0.0440 *	−0.0453 **
	(0.023)	(0.023)
ln_pGDP		0.0013	−0.0175
		(0.011)	(0.083)
real_exchange		0.0014	0.0045
		(0.003)	(0.008)
lndis		−0.0306 *
		(0.018)
lntrade		0.0223 ***	−0.0014
		(0.008)	(0.008)
comlang_off		0.2710
		(0.164)
comrelig		−2.1165 *
		(1.081)
Constant	0.0440 *	−0.0290	0.1933
	(0.023)	(0.218)	(0.711)
Observations	678	678	678
R-squared	0.005	0.225	0.474
Country FE	No	No	Yes
Year FE	No	Yes	Yes

Robust standard errors in parentheses. *** p < 0.01, ** p < 0.05, * p < 0.1. Note: This table reports the placebo test results, where the policy implementation year is artificially set to 2016 instead of the actual GDPR implementation in 2018. The purpose of this test is to examine whether the main DID estimates are driven by random time fluctuations or model specification rather than the actual GDPR shock. Column (1) presents the pooled OLS specification without fixed effects. Column (2) adds year fixed effects, while Column (3) reports the two-way fixed effects model including both country and year fixed effects. The interaction term FakeEU_Post = EU × fake post captures the post-policy treatment effect under the placebo scenario. Robust standard errors are clustered at the country level to account for potential correlation of errors within the same country over time.

in Appendix D reports the results of this test. Specifically, in the model without fixed effects (Column 1), the coefficient of FakeEU_Post is 0.0015. After adding year fixed effects (Column 2), the coefficient becomes −0.0015. When two-way fixed effects are included (Column 3), the coefficient is 0.0044. Across all three model specifications, the fake policy interaction term does not reach statistical significance (p > 0.1), and the direction of the coefficient fluctuates randomly. This indicates that the fake policy does not generate any systematic impact on the cross-border M&A activities of Chinese digital firms in the EU.

This result suggests that the statistically insignificant effect in the baseline DID estimation is not driven by random time fluctuations or model specification bias. In other words, the cross-border M&A activities of Chinese digital firms in the EU are not affected by the placebo policy shock, which strengthens the credibility of the model’s identification strategy. Therefore, this placebo test further supports the robustness of the DID model in identifying the policy effect of the GDPR.

7. Discussion

The empirical findings of this study indicate that the GDPR does not exert a statistically significant inhibitory effect on cross-border M&A activities of Chinese digital enterprises in the EU. This result remains consistent across multiple robustness tests, including estimations of two-way fixed effects models, sample adjustments, and the selection of alternative dependent variables, thereby enhancing the credibility of the estimation results. However, this finding should be interpreted with caution, as the lack of statistical significance does not necessarily imply that there is no economic impact. Our findings contrast with those found in some studies focusing on operational impacts of the GDPR on digital enterprises, while also providing new empirical evidence regarding the policy implications of the GDPR.

First, differing from the significant impacts on data collection, advertising markets, and algorithmic capabilities emphasized in studies by Aridor et al. (2023), Johnson et al. (2023), and Goldfarb and Tucker (2011), this study does not find evidence of a statistically significant or immediate negative effect of the GDPR on cross-border M&A activities of Chinese digital firms. This difference may stem from differences in behavioral mechanisms. The existing studies focus primarily on data-dependent, high-frequency operational activities, whereas cross-border M&A represents a strategic, low-frequency, and long-duration investment decision. Consequently, such decisions may be less sensitive to short-term changes in data availability than activities such as advertising optimization or platform algorithm design. Moreover, M&A decisions typically involve multiple factors such as strategic market structure and corporate governance, which may slow their adjustment to regulatory shocks.

Moreover, in contrast to studies that emphasize the institutional frictions and higher entry costs induced by GDPR (e.g., Voss & Houser, 2019), the results of this study do not provide evidence of a statistically significant inhibitory effect of the regulation on the short-term cross-border expansion of Chinese digital firms. This finding is consistent with institutional adaptation theory (Peng et al., 2008) as well as the technology–institution complementarity framework proposed by Xu et al. (2024). In other words, although GDPR increases compliance costs, enterprises may partially internalize the negative effects of institutional shocks through “institutional adaptability,” thus maintaining the stability of their expansion. In particular, within the more stringent two-way fixed effects estimation framework, the policy shock still fails to demonstrate a significant inhibitory effect, further indicating that firms possess a certain capacity for institutional adaptation in the short term.

Second, the findings of this paper do not contradict the extant literature suggesting that the GDPR strengthens industry concentration and enhances the competitive advantage of large platforms (Peukert et al., 2022; Zhao et al., 2021). Those studies primarily focus on the impact of the GDPR on industry structure, which mainly occurs at the operational level, whereas cross-border M&A reflects a capital-level expansion strategy, which responds differently to regulatory changes. In addition, the results suggest that the constraints faced by Chinese digital enterprises in entering the EU market may be more strongly associated with long-standing structural barriers, such as stringent institutional frameworks, regulatory complexity, and cultural distance. In model specifications where the EU dummy variable remains identifiable, its coefficient is consistently negative and statistically significant, supporting this interpretation. Accordingly, rather than implying that the GDPR is irrelevant, the findings indicate that its impact may be relatively limited compared to these broader structural constraints.

Finally, from the perspective of comparative advantage restructuring (Neary, 2007), competitive advantages in the contemporary digitized world shift from traditional cost and market advantages toward digital governance capabilities and institutional adaptability. Although GDPR increases compliance costs and requirements, the improvement in compliance capabilities among some Chinese enterprises also signifies their ability to build “new comparative advantages” under the new regulatory environment (Luo, 2021). This perspective provides a possible explanation for why cross-border M&A activity does not exhibit a statistically significant decline. Importantly, this does not imply that firms have fully adapted to the new institutional environment but rather suggests an ongoing process of dynamic adjustment in response to regulatory shocks.

In summary, the findings of this study not only extend the existing GDPR literature by providing evidence on firms’ transnational investment behavior but also highlight the role of institutional adaptation by digital enterprises under global regulatory regimes. More broadly, the results contribute to a deeper understanding of the internationalization strategies of digital firms, the dynamic restructuring of comparative advantages, and corporate responses to evolving digital regulatory environments.

From the perspectives of institutional economics and the theory of comparative-advantage restructuring, the empirical findings can be interpreted within a coherent theoretical framework. Although GDPR may increase compliance costs for digital enterprises, the results do not provide evidence of a statistically significant inhibitory effect on cross-border M&A activities. This may reflect that Chinese firms are able to mitigate institutional frictions through improvements in institutional adaptability, thereby maintaining relative stability in their short-term investment activities. Importantly, this does not imply that firms have fully adapted to the new regulatory environment; rather, it suggests the presence of a degree of flexibility and dynamic adjustment capacity. Accordingly, the observed outcome is more appropriately interpreted as a manifestation of “short-term adaptability” rather than the absence of institutional constraints.

The behavior of Chinese enterprises in responding to institutional constraints could be interpreted as a form of “institutional interaction effect.” In other words, enterprises seek coordination and balance in the external environment to maintain their expansion and investment paths under high compliance costs. This interpretation is consistent with the framework developed by Hall and Soskice (2001), which emphasizes the relationship between institutions and corporate strategy. Although firms’ behavior is influenced by the institutional environment, they also make strategic adjustments that drive the evolution and reproduction of institutional structures, thereby facilitating the emergence of new forms of comparative advantage (Hall & Soskice, 2001).

Therefore, the absence of a statistically significant inhibitory effect of the GDPR on cross-border M&A activities should not be interpreted as evidence of no impact. Rather, it suggests that firms may absorb or offset the negative effects of institutional shocks through adaptive and strategic responses. In conclusion, these findings underscore the importance of accounting for both institutional constraints and firm-level adaptability when evaluating the impact of global regulatory changes on cross-border investment behavior.

Potential Explanations for the Insignificant Findings

While the above interpretations provide a theoretically grounded explanation for the observed null effect, it is also important to consider that this finding may be driven by alternative mechanisms rather than the isolated impact of the GDPR.

First, compared with non-EU host markets, the EU market may involve stronger structural barriers, such as complex regulatory systems, institutional differences, and cultural distance, which could impose more fundamental constraints on Chinese firms’ investment decisions (Erel et al., 2012; Ahern et al., 2015). At the same time, the implementation of the GDPR overlaps with other regulatory developments, such as the gradual strengthening of the EU FDI screening framework (European Union, 2019). The coexistence of multiple institutional regulations implies that overlapping policy effects may weaken the identifiability of the independent effect of the GDPR.

Furthermore, industry-level heterogeneity may also contribute to the insignificant overall effect. Although this study systematically classifies sample firms based on the SDC database (Stats SA, 2025), industries differ substantially in terms of data dependence and compliance sensitivity. Approximately 31.8% of the firms belong to the ICT and digital services sectors, including data processing and software publishing, which are highly sensitive to data regulation (Refinitiv, 2024). In contrast, the remaining 67.8% of the firms are mainly distributed across professional services, media, and related sectors, which are relatively less directly exposed to data compliance shocks (Refinitiv, 2024). This imbalance in industry composition may dilute the actual impact of the GDPR on highly data-dependent firms at the aggregate level.

In addition, firms may strategically adjust their investment pathways in response to external regulatory constraints to mitigate potential shocks. For example, firms may turn to non-EU markets, adopt indirect investment structures, or complete transactions through third-party intermediaries, thereby diversifying risk without completely exiting the target market (Peng et al., 2008; Xu et al., 2024). This suggests that firms may internalize institutional constraints through adjustments in organizational forms and investment strategies. Therefore, the impact of regulatory policies may not be directly reflected in changes in the number of M&A deals but may instead be partially absorbed through adjustments in investment structures and paths.

Finally, the results of this study may also reflect firms’ short-term transitional adjustment processes. Cross-border M&A is a long-term and strategic investment decision (Caiazza et al., 2017), typically involving multiple stages such as target identification, due diligence, regulatory approval, and post-merger integration (Caiazza et al., 2017). Therefore, firms’ responses to institutional shocks may not usually be immediately reflected in short-term changes in M&A activities. The statistically insignificant results identified in this study are more likely to reflect firms’ short-term adjustment and adaptation processes under institutional shocks, rather than indicating that GDPR has no significant inhibitory effect in the long term. From the perspective of institutional adaptation theory, this also suggests that firms may mitigate institutional frictions through gradual adaptation rather than passively exiting the market.

8. Limitation & Policy Recommendation

8.1. Limitation and Future Research

The sample period only covers 2014–2021, but cross-border M&A constitutes a long-term strategic activity (Caiazza et al., 2017). The short sample period may not fully capture the dynamic response processes of enterprises in terms of data compliance and organizational adjustments. The results of this study may not be directly extended to infer the long-term structural impacts of the GDPR. This may instead reflect firms’ short-term adjustment processes during the early stage of institutional transition. Therefore, the findings of this study should be interpreted with caution, and future research could employ a longer time horizon to further examine the long-term effects of the GDPR on firms’ cross-border M&A strategies.

This study relies on country–year-level aggregated data, which prevents direct observation of firm-level strategic adjustments. Examples include investments in compliance technologies, implementation of data localization, and cross-border structural adjustments. This aggregation may also mask heterogeneity across firms and industries. In addition, the potential impact of the GDPR on internal decision-making levels within organizations cannot be fully captured by existing data. Future research could integrate firm-level data to identify the micro-level transmission pathways of institutional shocks.

Another limitation of this study relates to the heterogeneity of firms within the digital economy. Although this study further converts the original SIC industry classifications into internationally comparable ISIC Rev.4 categories based on the SIC–ISIC correspondence table, firms within the digital economy may still differ substantially in their dependence on data resources, business models, and institutional adaptation capacities. For example, compared with less data-dependent firms, data-intensive enterprises are more likely to be directly affected by the GDPR. Similarly, large firms and small and medium-sized enterprises may have different levels of compliance capability and institutional adaptability. The baseline empirical analysis of this study is conducted using country–year aggregated cross-border M&A observations rather than firm-level panel data. Due to the limitations of the data structure, the empirical analysis does not further estimate sub-sector heterogeneity. The reason is that further dividing the sample into narrower industry categories or firm-size groups would substantially reduce the number of observations within each subgroup and may generate unstable estimates, especially considering that cross-border M&A is itself a low-frequency economic activity. Therefore, the statistical findings of this study mainly reflect the average policy impact of the GDPR on Chinese digital-economy-related cross-border M&A activities at the aggregate level, while some degree of heterogeneous responses may still exist across different types of firms. Future research could further use transaction-level or firm-level data with a longer observation window to examine the effects of the GDPR on different industry categories and firm sizes.

Finally, the estimated effects may be influenced by concurrent policy developments during the sample period. In particular, the implementation of the EU FDI screening framework in 2019 (European Union, 2019) introduced additional regulatory scrutiny on foreign investments, especially those involving strategic sectors and non-EU investors (European Union, 2019). This policy may affect both the feasibility and timing of cross-border M&A activities, thereby interacting with the impact of the GDPR. More broadly, the EU regulatory environment has become increasingly stringent in areas such as data governance, competition policy, and investment screening, which may jointly shape firms’ investment decisions. As a result, it remains challenging to fully isolate the independent effect of the GDPR from other overlapping institutional changes. Although this study employs a two-way fixed effects framework and conducts additional robustness tests, including the exclusion of post-2019 observations, to mitigate potential confounding influences, the possibility of multi-policy interaction effects cannot be entirely ruled out.

8.2. Policy Recommendations

Although the empirical findings of this study indicate that the GDPR has not significantly inhibited cross-border M&A activities by Chinese digital enterprises in the EU in the short term, the long-standing structural entry barriers in the EU market remain a major internationalization challenge for firms. Therefore, the following actionable policy recommendations are proposed at the levels of governments, regulatory bodies, and enterprises.

The Chinese government could promote the establishment of a cooperation mechanism for data governance with the EU. Specifically, the government could promote the signing of a bilateral “data cross-recognition agreement” to reduce repeated reviews and certification costs. In addition, the Chinese government can develop cross-border data service platforms for enterprises, providing centralized support such as policy interpretation, risk alerts, and compliance consulting to help firms reduce uncertainty.

For regulatory authorities, there are options to improve the establishment of relevant compliance systems to enhance the transparency and operability of cross-border data processing by enterprises. Regulators could issue detailed guidelines and case studies on overseas data compliance. They could also consider establishing a “data sandbox” to allow firms to test cross-border data processing solutions in controlled pilot environments and identify risks in advance. Moreover, they could attempt to establish standardized data evaluation models to encourage companies to conduct institutional due diligence before mergers and acquisitions.

Chinese digital firms should proactively strengthen their institutional adaptability. Before engaging in cross-border M&A, firms should conduct comprehensive data-compliance risk assessments to evaluate whether the data-management practices of the target company align with GDPR requirements. In practical operations, firms could enhance their compliance capabilities by implementing measures such as data localization, categorized management, and the principle of minimizing data collection. At the technical level, companies could increase investment in security tools such as data encryption and access control to offset compliance risks. In addition, enterprises could also establish a cross-functional compliance team involving legal, technical, and operational staff to improve organizational responsiveness to unfamiliar foreign environments. These measures could help firms maintain strong competitiveness and institutional adaptability under a stringent regulatory context.

9. Conclusions

This study analyzes the policy effects of the General Data Protection Regulation (GDPR) using a Difference-in-Differences (DID) model, based on the data on cross-border M&A behaviors by Chinese digital enterprises in the EU from 2014 to 2021. The results do not provide evidence of a statistically significant inhibitory effect of the GDPR on the number or value of cross-border M&A activities by Chinese digital companies in the EU in the short term. Instead, the findings suggest that firms may maintain their expansion by enhancing institutional adaptability, such as strengthening compliance systems or localizing operations. At the same time, the results indicate that long-standing structural barriers to entry in the EU remain important, reflecting that cultural and institutional differences remain the primary challenges for Chinese enterprises in their international expansion. The conclusion remains consistent across various identification strategies, including two-way fixed effects models, sample adjustment tests, and dependent-variable substitution tests, indicating that the results are robust.

From a broader perspective, this study highlights that comparative advantage in the digital economy is increasingly shaped by institutional adaptability, technological capability, and learning capacity, rather than traditional factor endowments. In this sense, the ability of firms to respond flexibly to strict regulatory environments is emerging as a key dimension of competitiveness under global digital governance.

However, this study has several limitations. The analysis is based on country–year-level data and a relatively short sample period, which may limit the ability to capture firm-level differences and long-term adjustment processes. In addition, other policy changes during the same period, such as the EU FDI screening framework, may interact with the GDPR and make it difficult to isolate its independent effect.

Future research could extend this study by using firm-level data, examining differences across industries, and exploring the long-term impact of regulatory changes. It would also be useful to further distinguish the effects of different policies, to better understand how firms respond to complex and changing regulatory environments.

This study also reveals that comparative advantage is shifting from the traditional factor endowment-driven perspective toward an “adaptive comparative advantage”, which focuses on institutional adaptability, technological integration, and learning capacity. Institutional responses and flexibility are emerging as new competitive advantages in the context of higher institutional entry barriers. Overall, this research enriches the study of cross-border M&A and institutional adaptation within the digital economy context and provides empirical evidence and practical insights for policy development and international expansion strategies.