The dramatic growth of the digital economy has led to widespread increases in the collection, storage, process, and dissemination of personal data, making data privacy an important and pressing issue for firms, policymakers, and researchers. The prior literature on privacy protections has largely documented their negative impacts on organizational outcomes, such as impeding technology adoption and diffusion, reducing the efficacy of advertising, lowering financial performance, and hindering startups’ fundraising. While the literature has provided empirical evidence of several economic consequences of privacy protections, it has thus far provided limited insights into the role of privacy protections in firm scaling and its associated implications for corporate strategy. To address this gap, in the current paper we investigate the following two research questions: How do privacy protections affect firm scaling? And, how do changes in scaling (opportunities) affect firm scope? Since enhanced privacy protections limit digital firms’ ability to leverage data network effects and data-driven learning, we posit that they are associated with a decrease in firm scaling. Further, when firms experience a decrease in scaling, they are more likely to expand their scope. This is because decreased scaling reduces the opportunity costs of spreading resources across multiple businesses. To test our hypotheses, we leverage a quasi-natural experiment provided by the enactment of General Data Protection Regulation (GDPR) in E.U. in 2018. Using a difference-in-differences methodology, we find that the implementation of GDPR is associated with a 37.7% decrease in scaling relative to the mean value of scaling pre-GDPR. To examine the relationship between scaling and firm scope, we adopt an instrumental variable (IV) approach that uses the firm’s exposure to GDPR as an IV for firm scaling. The IV estimates show that the decrease in scaling associated with GDPR implementation relates to a 36.0% increase in diversification relative to the mean value of diversification pre-GDPR. We conduct further supplementary analyses to validate our identification strategies, explore heterogenous treatment effects, and verify the robustness of our primary results. These findings seek to extend the emerging stream of research on scaling, contribute to the scholarship on corporate strategy, and provide valuable insights for policymakers.
