When a regulatory burden is a competitive boon

The incipient surveillance economy is dominated by a duopoly: Google and Facebook. (Shall I call it GooF? Yes, I shall.) According to estimates, the two companies control somewhere between half and three-quarters of spending on digital-advertising throughout the world, and that already extraordinary share seems fated to rise even higher. Thanks to Google’s failure to develop a strong social-media platform, the two companies compete only glancingly. Their services are largely complementary, so both can continue to grow smartly without raiding each other’s revenues and profits.

The concentration of market power, and its possible abuse, is one of two broad and growing concerns the public has about the GooF axis. The other is the control over personal information wielded by the duopoly. Because personal-data stores provide the fuel for the ad business and the ad business feeds the data stores, the two concerns are tightly connected, to the point of being confused in the public mind. Those who fear GooF tend to assume that greater regulation on either the privacy front or the antitrust front will help to blunt the comanies’ power, bringing them to some sort of heel. If legislators or judges won’t break up the giants or circumscribe their expansion, the thinking goes, at least we can rein them in by putting some constraints on their ability to collect and exploit personal information.

But, with Europe’s General Data Protection Regulation set to go into effect in a month, it’s suddenly becoming clear that the reality is going to be very different from what’s been assumed. New privacy regulations are likely to give Google and Facebook even more market power. Far from being weakened, the duopoly will end up competitively stronger, better insulated from new and existing rivals. “Privacy Rules May Strengthen Internet Giants,” runs the headline on the front page of today’s New York Times. Reads the headline on a similar article in the Wall Street Journal: “Google and Facebook Likely to Benefit from Europe’s Privacy Crackdown.”

The reason is simple. It costs a lot of money and time to comply with regulations, particularly the kind of complex technical regulations that affect digital commerce, and the compliance costs place a far greater burden on small or fledgling competitors than they do on big incumbents. Google and Facebook already have armies of lobbyists, lawyers, and programmers to navigate the new rules, and they have plenty of free cash available to invest in compliance programs. They’ll be able to meet the regulatory requirements fairly easily. (And they even have the power to shift some of the cost burden onto the publishers who use their ad networks, as the Journal notes.)

If you’re operating a smaller ad network, the added compliance costs will be much more onerous, perhaps ruinously so. Worse yet, the new regulations may well give your customers an incentive to shift their business over to the dominant players. In an environment of legal uncertainty, companies seek safety, and safety lies with the big, established suppliers. And if you’re a brave entrepreneur who’s been thinking of taking on GooF by launching a new social network or search system, well, the already daunting entry barriers will be made even more daunting by the new compliance costs and by customers’ flight to safety. When, in his recent Congressional testimony, Mark Zuckerberg said he welcomed more regulation, he was not being the selfless soul he pretended to be.

I’m not arguing against new data-privacy regulations. They may well protect the public from abuse, or at least give the public a clearer view of what’s really going on with personal data. What I am suggesting is that the regulations, imposed in isolation, seem likely to have the unintended effect of further reducing competition in the digital advertising market and hence buttressing the surveillance-economy duopoly. The online world will end up even GooFier.