This paper models how regulatory attempts to protect the privacy of consumers’ data affect the competitive structure of data-intensive industries. Our results suggest that the commonly used consent-based approach may disproportionately benefit firms that offer a larger scope of services. Therefore, though privacy regulation imposes costs on all firms, it is small firms and new firms that are most adversely affected. We then show that this negative effect will be particularly severe for goods where the price mechanism does not mediate the effect, such as the advertising-supported Internet.