View article

Despite the growing interest in understanding the big data revolution and its implications for business, our knowledge has remained limited regarding the evolution of firms’ data practices and their strategic and economic implications. In this study, we focus on firms’ practices related to data privacy. We quantify firms’ attention to data privacy via a text analysis of US publicly listed firms’ annual reports. We show that firms’ attention to data privacy responds to changes in regulatory, normative, and competitive pressures and has substantial financial implications. US firms increased attention to data privacy as a result of their exposure to the European GDPR regulation and data breaches in their industry. Firms responded similarly if their competitive peers were exposed to the regulation or a breach. The increased attention to data privacy contributed to a reduced market valuation. These findings suggest that firms that respond to regulatory, normative, and competitive threats related to data privacy expend managerial attention and resources on data practices and technologies, but such practices do not allow them to differentiate themselves in the market. However, firms with technological capabilities in data analytics (machine learning patents) and those with a market presence in weak data privacy regimes were able to mitigate the adverse effects of stringent demands for data privacy. We discuss the broader managerial and policy implications of these findings as well as the potential avenues for future research.