Rico Bornschein, Lennard Schmidt, Erik Maier

• Recent regulation in the European Union (i.e., the General Data Protection Regulation: GDPR) affects websites’ information privacy practices. This regulation addresses two dimensions: websites must (1) provide visible notice about which private information they collect through cookies and (2) allow consumers the choice to disagree to such tracking. Policy makers need to understand the degree of implementation of their regulation, but also its effect on consumers. We develop a typology of website cookie notices along the dimensions notice visibility and choice. A field study shows that most websites only offer low notice visibility and limited choice over the collection of private information. In addition, four experimental studies in the EU and United States explore the effects of information privacy practices: while offering choice over whether or which data are used increases consumer power, visibility of the notice (vs. no notice) only affects risk perceptions. We establish the novel suggestion that perceived risk is mitigated if consumers have more choice over their data (indirectly through greater power). Power and risk influence consumers’ affect and purchase intent.