Why are there so few unicorns in Europe?

Despite a GDP that is about the same size as the US, but with about twice the population, the EU produces relatively few unicorns (billion dollar startups) because the regulatory burden is so heavy.  A recent example is the GDPR,

Controllers of personal data must put in place appropriate technical and organisational measures to implement the data protection principles. Business processes that handle personal data must be designed and built with consideration of the principles and provide safeguards to protect data (for example, using pseudonymization or full anonymization where appropriate), and use the highest-possible privacy settings by default, so that the data is not available publicly without explicit, informed consent, and cannot be used to identify a subject without additional information stored separately.

MarginalRevolution has another great post  that documents the compliance costs, especially for would-be unicorns :

• Startups: One study estimated that venture capital invested in EU startups fell by as much as 50 percent due to GDPR implementation. (NBER)
• Mergers and acquisitions: “55% of respondents said they had worked on deals that fell apart because of concerns about a target company’s data protection policies and compliance with GDPR” (WSJ)
• Scientific research: “[B]iomedical researchers fear that the EU’s new General Data Protection Regulation (GDPR) will make it harder to share information across borders or outside their original research context.” (POLITICO)
• Microsoft had 1,600 engineers working on compliance. (Microsoft)
• During a Senate hearing, Keith Enright, Google’s chief privacy officer, estimated that the company spent “hundreds of years of human time” to comply with the new privacy rules. (Quartz)
  • However, French authorities ultimately decided Google’s compliance efforts were insufficient: “France fines Google nearly $57 million for first major violation of new European privacy regime” (The Washington Post)

Find the problem before you own it

All of these companies could have benefitted from the advice of Chapter 19, "Anticipate adverse selection."  

• in 2016, Marriott acquired Starwood for $13.6 billion, unaware that Starwood's reservation system had been attacked which exposed personal data of nearly 500 million of its customers.
• In 2017, Verizon discounted its original $4.8 billion purchase price of Yahoo by $350 million after it learned--post­ acquisition--of the latter's data breach exposures. 
•  In 2016, Abbott announced the acquisition of St. Jude Medical, a medical device manufacturer based in Minnesota, only to learn of a hacking risk in 500,000 of St. Jude's pacemakers a year later in 2017. Abbott ending up recalling the devices.    

BOTTOM LINE:  when purchasing an item of unknown value (you don't know whether a target acquisition has hidden liability associated with data breaches), anticipate that the target may have better information than the acquirer which would make the target more likely to sell because the target knows it is not worth what the acquirer has offered.  Acquirers should "find the problem before they own it." (HBR Article)

Evidence that acquirers are anticipating adverse selection:  After the EU adopted stricter liability associated with data breachers in the form of GDPR, venture capitalists were less likely to invest in startups or and a number of deals fell apart:

• One study estimated that venture capital invested in EU startups fell by as much as 50 percent due to GDPR implementation. (NBER)
• “55% of respondents said they had worked on deals that fell apart because of concerns about a target company’s data protection policies and compliance with GDPR” (WSJ)

HT:  Danny Sokol & MarginalRevolution.com

Adverse Selection into Privacy Protection

The recently enacted General Data Protection Regulation (GDPR) allows EU citizens various privacy protections, including the ability to opt out of data collection schemes. In a new paper, Aridor, Che, Nelson, and Salz find that a sizable fraction of the population, presumably those who are more sensitive to privacy issues, does opt out. How does this affect those that do not? They become even more "persistently trackable" because those who opt out now do not generate as much noise on those remaining.

Further in keeping with this hypothesis, we observe that the average value of the remaining consumers to advertisers has increased, offsetting most of the losses from consumers that opt-out. 

Hat tip: Marginal Revolution

How would you align the incentives of a Data Protection Officer with the goals of the organization?

 In a previous posts, we have blogged about the onerous EU privacy rules.  Just came across another, a GDPR Data Protection Officer or DPO.

According to Article 38, other employees in the organization aren’t allowed to issue any instructions to the DPO regarding the performance of their tasks. So, not only does the DPO have wide-ranging responsibilities, but the position is shielded from potential interference from the organization.

Wow. What is the performance metric, and are you prohibited by law from tying pay to performance as it could constitute "interference?"

Why the U.S. Produces More Unicorns than the EU

The United States has produced about twice as many unicorns (private startups valued at $1B+) as China and more than four times as many as the European Union. These numbers reflect institutional and cultural advantages in the U.S. startup ecosystem.

Table: Number of Unicorns Created Since ~1990

Region	Cumulative Unicorns
United States	~1,950
China	~970
European Union	~450

Source: Estimates based on Hurun Global Unicorn Index 2024 and Strebulaev & Gornall, Stanford Venture Capital Initiative. Includes both active and exited unicorns created since ~1990.

Why the Disparity?

• Tolerance for Inequality:  The US gap between rich and poor is bigger than in any other advanced country, but most Americans want to join the rich, not soak them. The EU taxes inquality.
• Bankruptcy Laws Forgive Failure: U.S. founders can declare bankruptcy and get a clean slate in ~7 years. EU bankruptcy regimes are often punitive, with long-term credit restrictions. That discourages risky ventures. The U.S. treats failure as a résumé item, not a moral failing.
• Unified market: A U.S. startup can scale across 330 million consumers under one legal system. EU startups must navigate 27. It's harder to grow when your “domestic market” includes multiple languages, tax codes, and regulations.
• University spinouts: U.S. research universities are world leaders in tech transfer. Stanford alone has spun out over 200 unicorns. The Bayh-Dole Act helps universities commercialize IP. Europe is catching up, but still lags.
• Easier exits (acquisitions) lead to more entry:  investors require an exit.  
• Immigration to the US Nearly half of U.S. unicorn founders were born outside the U.S. If you have a good idea, you can more easily act on it in the US.
• Lighter regulation: U.S. startups face less red tape. European data/privacy rules (e.g., GDPR), strict labor laws increase fixed costs and reduce flexibility.

---

Acknowlements:  This post based on research begun by Annie Cox, and Avi Goldberg, and Jack Underwood and finished by ChatGPT.