Regulation entrenches the incumbents
November 13, 2020
2 min read
“Big tech needs more regulation” say policymakers in both the US and the EU. Introducing new regulations seem like a useful tool to control the power big tech has, e.g. to hold them to account with respect to privacy and data protection using GDPR. However, regulations have side-effects that can actually make the consumer experience worse, and entrench the power of the incumbents.
Regulation provides a high fixed-cost that inhibits new competitors entering a field. In order for firms to comply with GDPR regulations, they must set up (amongst other things) an auditing structure and appoint Data Protection Officers, which have significant costs both in terms of time (the average organisation spent 2000-4000 hours preparing for GDPR) and money ( 74% of companies spent more than $100,000). Penalties for non-compliance are more likely to hurt startups than incumbents - a fine of €2 million could be a death sentence for a startup. The cost of consent for users is far outweighed by the perks of the service bundle offered by incumbents. Finally, in addition to the fixed costs of running the business and onboarding new users, incumbents are less reliant than startups on using data collection to tailor product-market fit, so are less impacted by the increased regulation.
Some problems can’t be regulated because their solution is not clear or feasible. It is easy to regulate data processing. How do you regulate misinformation? AI can’t detect everything and the scale is too large for human moderators to handle. Data portability is an interesting example of the gap between reality and the ideal. Here, interoperability is only required if technically feasible (GDPR Article 20 Section 2). Interoperability can clearly promote more competition, as it mitigates network effects, however many incumbents have monolithic legacy systems, with significant technical barriers to achieving interoperability. What then?
Sometimes regulation can inhibit competition, particularly if the market forces incentivise the kind of behaviour that benefits consumers. Take the airline industry - in the 1960s and 1970s, prices were set by the Civil Aeronautics Board, however with the 1978 Airline Deregulation Act, airlines were free to set their own prices. This led to prices dropping and competition increasing, with the only regulated aspect of air travel being safety. Likewise taxi regulation meant taxis are no longer able to compete with Uber. Uber bulldozed through regulation and undercut traditional taxis’ fares, which led to it establishing a market share that meant it could strongarm local authorities - a clear failure of regulation.
Yes, regulations like GDPR do ensure a minimum bar for privacy and data protection, which a free market would likely disregard in favour of increased data collection. However, regulation is subject to lobbying and manipulated by the incumbents. For example, the provision for explicit user consent in GDPR has led to the normalisation of websites asking users to click to “accept all cookies” to get the full browser experience. Google requires publishers to get user consent in order to continue using its advertising services. By offloading the work required for GDPR compliance to publishers, it has negated the fixed costs and entrenched its position in the market.
The main way to unseat the incumbents is not through regulation, but rather the growth of a new market. Take Microsoft usurping IBM mainframes with the revolution of personal computing, or the Internet usurping Microsoft’s monopoly on personal computing. Perhaps the best way of incentivising privacy without benefiting incumbents is to introduce a new market of valuable large private datasets, such as those in healthcare. Startups that develop better privacy-enhancing technologies could have access to greater magnitudes of private data, through which they could overcome Big Tech’s incumbent data advantage.
Subscribe to my newsletter!
I write a mixture of tutorials, comment pieces and technical content on my blog.