By regulating how firms collect, store, and use data, privacy laws may change the role of data in
production and alter firm demand for information technology inputs. We study how firms
respond to privacy laws in the context of the EU’s General Data Protection Regulation (GDPR)
by using seven years of data from a large global cloud-computing provider. Our difference-indifference estimates indicate that, in response to the GDPR, EU firms decreased data storage by
26% and data processing by 15% relative to comparable US firms, becoming less “dataintensive.” To estimate the costs of the GDPR for firms, we propose and estimate a production
function where data and computation serve as inputs to the production of “information." We find
that data and computation are strong complements in production and that firm responses are
consistent with the GDPR, representing a 20% increase in the cost of data on average. Variation
in the firm-level effects of the GDPR and industry-level exposure to data, however, drives
significant heterogeneity in our estimates of the impact of the GDPR on production costs.