This paper analyzes consumers' privacy choice concerning their private data and firms' ensuing pricing strategy. The General Data Protection Regulation passed by the European Union in May 2018 allows consumers to decide whether to reveal private information in the form of cookies to an online seller. By incorporating this endogenous decision into a duopoly model with behavior-based pricing, we find two contrasting equilibria. Under revelation to both firms, consumers disclose their information. Under revelation to only one firm, consumers hide their information. Based on the model, we design a laboratory experiment. We find that there is a large share of consumers who reveal their private data. Particularly, less privacy-concerned subjects and subjects in the setting where only one firm receives information are more likely to reveal information.