U.S. tech giants shouldn't have a problem meeting Europe's new data privacy standards, but it's going to cost them.
Over the last few weeks, Facebook Inc., (FB) - Get Facebook, Inc. Class A Report Alphabet Inc., (GOOGL) - Get Alphabet Inc. Class A Report , Apple Inc. (AAPL) - Get Apple Inc. (AAPL) Report and scores of other U.S. tech firms have been busy changing their data policies and communicating with users to comply with the European Union's General Data Privacy Regulation, or GDPR, which goes into effect on May 25.
Unlike retailers and banks, tech companies are well-equipped to adapt to the new rules, said AT Kearney principal Rajesh John.
"They're more agile, more flexible," John said. "They know how to move faster in the data management space because their business has always been oriented around monetizing data."
The GDPR mandates that any company that operates in Europe must ask users for explicit consent surrounding the collection and use of data, give users the "right to be forgotten" (i.e., to have their personal data erased without "undue delay") and to maintain a high level of security for the personal data they have. For retailers and banks this includes financial data, while for companies like Facebook and Google, this includes personal profile information along with search history and other data used to target advertising on the platforms.
Companies have been doing this over the past month or so, with Apple Inc. (AAPL) - Get Apple Inc. (AAPL) Report announcing on May 22 that users will be able to request copies of their data stored by Apple, per GDPR's conditions. Many companies have been emailing users to opt-in to their new privacy policies in order to continue using their services or platforms.
For its part, Facebook released its new policies in mid-April after the Cambridge Analytica data misuse scandal, and on May 24 the company announced that all Facebook users, not just those in Europe, will be asked to review and opt in to its policies through an alert on the news feed.
"We introduced a similar experience in the European Union as part of our preparation for the General Data Protection Regulation (GDPR), and now we're making it available everywhere," Erin Egan, Facebook's chief privacy officer, wrote in a blog post on Thursday. As of March 31, Facebook reported having 282 million daily active users in Europe, and 1.4 billion users worldwide.
Tech companies have a lot more to lose than other types of firms as a result of changing regulations around user data, according to John. But Gil Luria, DA Davidson's director of research, said that changing policies and data collection and storage processes will all come at varying costs to tech firms depending on how much data they collect.
"These companies are in the business of capturing information and monetizing it," Luria said. "And they have, up until recently, been able to do so with very little cost associated with the collection, storage, sale and use [of data]."
Companies such as Facebook and Google will have an easier time complying with the new regulation than smaller firms, as they are "enormous corporations that are extremely well-funded," said Gartner research director Matt Stamper.
"Their ability to withstand the legal expenses and opportunity cost of time and energy for teams to deal with privacy is in a different league than [a start-up] hiring a data protection officer and third party lawyers," Stamper said.
But new requirements such as the need for opt-in consent to collect personal data could limit or reduce the amount of data they can collect, which could hurt revenues, Luria said.
The impact of the new rules on user growth or revenue won't be known for a while, as the regulation goes into effect midway through Facebook and Google's second fiscal quarter and Apple's third fiscal quarter, all of which end in June.
In addition to the costs of compliance, there is also a hefty fine for not complying with the new privacy conditions: up to 4% of the company's annual revenues or €20 million ($24.6 million), whichever is more.
"If you're a large internet company, you don't want to get this wrong," Luria said. "A vague description [of policies] is not going to be good enough anymore."
Since the beginning of the year, Facebook shares have increased 5.3%, while Alphabet shares have risen 2.2%. Apple's stock has increased 10.5%.