We study the international protection of consumer data in a model where data usage benefits firms at the expense of their customers. We show that a multinational firm does not balance this trade-off efficiently if its data usage lacks (full) transparency or if consumers’ privacy preference differs across countries. Unilateral data regulation by each country addresses the moral-hazard problem associated with opacity, but may nevertheless reduce global welfare due to cross-country externalities that distort output and data usage. The regulations may also cause excessive investment in data localization, even though localization mitigates the externalities. Our findings highlight the need for international coordination - though not necessarily uniformity - on regulations about data usage and protection.