The rapid advancement in artificial intelligence (AI) and computing power has significantly elevated the value of data, making it a critical asset for firms. I measure firms' value of data and consumers' privacy preferences by analyzing the supply and demand-side reactions to the EU’s General Data Protection Regulation (GDPR). After GDPR limits firms’ access to data, the EU sales share of US data-intensive firms declines by 8%. EU consumers, who can choose to share less data, suffer a 6% deterioration in user experience as measured by app ratings. I develop a general equilibrium model to map these empirical findings and estimate the value of data and privacy. Privacy-conscious consumers gain from privacy protection. However, the quantitative model reveals that the digital welfare of other consumers declines because firms also use data to enhance productivity and customize digital products. In aggregate, EU digital welfare declines by 4%, and US digital welfare declines by 1.4%.