The EU's General Data Protection Regulation (GDPR) mandates explicit user opt-in consent for data access. It recommends transparency in opt-in requests about data collection, storage, and use, without specifying the format of these requests. Consequently, the GDPR gives firms flexibility in designing opt-in messages. This research uses theory, multiple datasets, and methods to investigate firms’ communication formats for opt-in requests, addressing three questions: 1) how do firms design their opt-in requests? 2) does the chosen format affect consumer response? 3) what drives firms' choices of formats? The analysis of 1,506 re-permission emails from 1,396 firms post-GDPR shows that 26% use only persuasive cues to request data, while 24% blend persuasive and informative cues. Notably, businesses with an offline presence use more persuasive cues compared to purely digital entities. A field experiment rationalizes this behavior showing that informative cues alone did not improve opt-in; a mix of persuasive and informative cues proved more successful. Additionally, firms dependent on personal data utilize persuasive cues more often than firms concerned with reputational risks of GDPR non-compliance. This study offers pivotal insights for regulators, firms, and consumers, revealing variations in how different firms acquire consent and the impact of their strategies on user behavior.

中文翻译：

---

EXPRESS：数据竞赛：利用信息丰富或有说服力的线索来获得选择加入？


欧盟的《通用数据保护条例》(GDPR) 要求用户明确选择同意数据访问。它建议有关数据收集、存储和使用的选择加入请求的透明度，但不指定这些请求的格式。因此，GDPR 为企业提供了设计选择加入消息的灵活性。本研究使用理论、多个数据集和方法来调查公司选择加入请求的沟通格式，解决三个问题：1）公司如何设计他们的选择加入请求？ 2）所选择的格式是否会影响消费者的反应？ 3）是什么驱动企业选择格式？对 GDPR 生效后 1,396 家公司的 1,506 封重新许可电子邮件的分析显示，26% 的公司仅使用说服性线索来请求数据，而 24% 的公司混合了说服性线索和信息性线索。值得注意的是，与纯数字实体相比，拥有线下业务的企业使用更具说服力的线索。一项现场实验合理化了这种行为，表明仅提供信息提示并不能改善选择加入；事实证明，说服性和信息性线索的结合更为成功。此外，依赖个人数据的公司比担心 GDPR 不合规声誉风险的公司更频繁地利用有说服力的线索。这项研究为监管机构、公司和消费者提供了关键的见解，揭示了不同公司如何获得同意的差异以及其策略对用户行为的影响。