We demonstrate how privacy law interacts with competition and trade policy in the context of the European General Data Protection Regulation (GDPR). We follow more than 110,000 websites for 18 months to show that websites reduced their connections to web technology providers after the GDPR became effective, especially regarding requests involving personal data. This also holds for websites catering to non-EU audiences and therefore not bound by the GDPR. We further document an increase in market concentration in web technology services after the introduction of the GDPR. While most firms lose market share, the leading firm, Google, significantly increases market share.We highlight four key findings. First, websites have reduced the number of third-party domains that they request in the short-run after the GDPR, but the general upward trend is not changed much.However, when looking into a specific type of request -cookies -we find that websites' use of thirdparty technologies that interact with consumers' privacy has changed effectively with the GDPR. We observe a sustained decrease in third-party cookies and a sustained increase in first-party cookies.