Develops a game-theoretic model for “what if” scenarios on the impact of the European Union’s General Data Protection Regulation (GDPR) privacy and security policies on consumer behavior (data opt-in, right to be forgotten, and data portability) and firms’ use of data for personalization and price discrimination.