This paper empirically studies the location decisions of internet firms when they face high legal standards of privacy protection. Many factors might influence them: technological spillovers, lower taxation, and so on. Internet firms can also arbitrate national differences and many of them actually locate their activity in order to escape from national laws they consider over-stringent. In the current stage of development of the internet—the so-called Web 2.0—the ease of access to personal data proved to be strategic input. So the more a jurisdiction makes collecting and using these data easy, the more attractive the country is, if all other things remain constant. One way for a firm to avoid such legal restrictions is to locate or to expand its business in less privacy protective countries. Our empirical results support this ‘no-privacy haven’ hypothesis. In particular, we highlight a new privacy paradox according to which the more stringent certain online privacy laws are, the more they induce firms to locate their business in less stringent countries, and finally the weaker actual privacy protection on the internet is.