General Data Protection Regulation (GDPR) aims to protect consumer data privacy,
however, its adverse effects have been widely documented. We present a new model for
the analysis of consumer data acquisition under privacy regulation. We treat both data
and analytics as separate strategic variables and consider the heterogeneity of privacy costs
across consumers. Using this model to examine the impact of GDPR, we identify a market
failure before GDPR and nd that GDPR activates a market for data acquisition by im-
posing consent requirements on data acquisition. We further study the optimal design of
the mechanism for consumer data acquisition and deliver important policy implications for
implementing the social optimum