Which Privacy Policy Works, Opt-In Requirement or Inference Regulation? A Game-Theoretic Analysis of Privacy Policies in E-Commerce

With the rapid development of e-commerce, data-driven models have significantly enhanced service experience. We can obtain the optimal values for the price but have also intensified consumer privacy concerns. Among various privacy protection policies, which are more effective? Is there a governance framework that balances commercial efficiency with privacy safety? To address this, we develop a duopoly game-theory model that analyzes consumer behavior characterized by heterogeneous privacy costs and preferences, aiming to evaluate the impact of differentiated privacy protection policies within digital ecosystems. We analyze whether opt-in requirement or inference regulation is more advantageous for consumer and firm competition. We find that, in a competitive environment, imposing opt-in requirement on one party can yield competitive advantages and profit increases, whereas imposing inference regulation on the other may result in a competitive disadvantage. Such differentiated policies create an asymmetric competitive landscape, effectively avoiding a prisoner’s dilemma and, under certain conditions, increasing both consumer and total surplus. Furthermore, our study reveals significant differences in the impact of these policies on data-driven and usage-driven firms. Based on these findings, we recommend that regulators carefully tailor privacy protection policies according to industry-specific data characteristics, adopting differentiated regulatory strategies when appropriate and providing compensation mechanisms for disadvantaged firms to optimize total welfare.