Established commercial platforms log and analyze their users’ behavior in detail to build accurate personality profiles. That knowledge enables highly personalized advertising and forms the platforms’ business basis. Data collected by tracking services like Google Analytics and Meta Pixel are also used. Trackers are now embedded on nearly all publicly facing websites, in almost every commercial smartphone and laptop OS, and in payment systems like PayPal, MasterCard and Payback. Data brokers systematically combine and resell information from many sources. In practice almost everyone is affected—even those who avoid certain services and use common anti-tracking measures like ad blockers and VPNs—though those measures are still advisable.

Personalized advertising has clear benefits, including for potential customers. But this huge concentration of knowledge, together with society’s dependence on these platforms and services and the opacity of their recommendation algorithms and moderation decisions, creates an alarming concentration of power. Direct risks of abuse come from the platform operators, but indirectly also from third parties, such as cybercriminals or, in the future, an unethical government that persecutes certain groups. Many regulatory attempts have been made to curb this concentration of power and place it under democratic control—data-protection laws and transparency requirements, for example. These have had some success, but the problem remains. The geopolitical importance of platforms and digital services is increasingly recognized: the EU has pursued “digital sovereignty” in recent years. Still, the abuse potential is largely tolerated. It is also problematic that lawmakers tend to delegate enforcement tasks to private media platforms (see “privatized enforcement” and “platform deputization”). One example is platform liability for uploaded content under the EU’s DSM Directive, which effectively requires automatic filtering at upload. What sounds technically sensible and promises better control makes market entry harder for new platforms and thus reduces competition, because regulatory self-compliance often demands huge resources only established firms possess. As a result, innovative and potentially better approaches struggle to gain traction, and the status quo persists.

Market concentration in the tech sector (and beyond) is visible economically as well. It is now common for large tech firms to buy competitors or suppliers, bring them under control through market power, or push them out. Existing laws—shaped heavily by lobbying (see “regulatory capture”)—enable this. Modern antitrust law, especially in the U.S., has for decades focused on “consumer welfare,” an idea from the Chicago School of Economics. A core of that philosophy is to allow mergers as long as prices and availability for end consumers remain roughly stable.

At the same time, laws against circumvention of technical protection measures (see “anti-circumvention”), implemented by the DMCA in the U.S. and the InfoSoc Directive in the EU, are interpreted very broadly. This can make repairs artificially expensive or impossible (see “right to repair”), since offering compatible parts or performing repairs as a third party may be illegal. Such practices occur not only with end devices like computers and smartphones but also with OT devices (printer cartridges are a famous case) and even vehicles (see “VIN locking”). Consumers are often threatened with losing warranty claims if they attempt repairs or modifications themselves or use unauthorized technicians. Anti-circumvention is used widely in software too: technically, interoperability could be achieved without platform cooperation—for example, by building bridges between social networks. No one would have to stay on Facebook or WhatsApp just to reach friends, customers, and journalists (see “network effect”). Unofficial modifications and extensions that improve user experience are technically feasible. But efforts that gain traction are successfully suppressed through legal means.

Using this regulatory framework, companies can insulate their product ecosystems from competitors to lock in customers and make switching unattractive (see “vendor lock-in” in B2B, and “switching costs” or “walled gardens” for digital platforms). Under these conditions, firms that trap users most effectively often prevail over those offering the best products. The benefits of fair, free market competition are thus eroded while the downsides remain. The concentration of market power in large corporations further intensifies this effect.

If users cannot easily switch despite dissatisfaction, they can be monetized more: shown more ads and offered worse terms. This pattern is well documented and visible on many large commercial platforms (see “enshittification”).

Legally strengthening interoperability would undeniably bolster consumer rights and competition and spur innovation. History shows this is not inherently hostile to business models; it has enabled many innovations now taken for granted and underpinned countless companies across tech and beyond—unlike many Big Tech firms that maintain position by blocking others. Under Article 20 of the GDPR, EU citizens theoretically have a right to data portability: platforms must provide stored personal data on request in a common, machine-readable format. In practice this rule has proved a “toothless tiger” for various reasons.

The foundations of today’s platform landscape, the true extent of their influence, and how they might be controlled are complex and under-researched questions. It also remains open whether “fair” market competition still functions as intended.