Competition Law and Biometric Authentication Market Concentration

Competition Law and Biometric Authentication Market Concentration

1. Introduction

Biometric authentication means verifying or identifying a person through biological or behavioural characteristics such as fingerprints, facial geometry, iris patterns, palm or vein patterns, and voice characteristics. These technologies are increasingly used in smartphones, banking, airports, government identity systems, workplaces, payment services, and access-control systems.

From a competition-law perspective, biometric authentication creates an unusual market structure. A provider may obtain advantages from proprietary algorithms, very large biometric datasets, integration with operating systems or hardware, government contracts, technical standards, patents, and established customer relationships.

Market concentration therefore becomes important where a small number of companies control essential biometric technologies or the infrastructure through which biometric authentication is provided.

Competition law does not prohibit a company merely because it becomes large or technologically successful. The central question is whether market power is acquired or exercised in a way that substantially restricts competition—for example through exclusionary conduct, tying, discriminatory access, anticompetitive agreements, or acquisitions that remove meaningful competitive constraints.

Biometric markets also demonstrate that competition, privacy, cybersecurity and data-protection concerns can overlap. Privacy litigation involving facial recognition is therefore useful to competition analysis even though such cases are not necessarily antitrust cases.

2. Defining the Relevant Market

The first major competition-law problem is determining the relevant market.

It would normally be too broad simply to describe the market as the "technology market." Depending upon the facts, regulators might examine separate markets for:

• facial-recognition authentication;
• fingerprint authentication;
• iris-recognition systems;
• voice authentication;
• biometric identity verification;
• biometric access-control systems;
• biometric border-management technology;
• biometric authentication software development kits;
• biometric databases or matching services; and
• integrated digital-identity platforms.

Demand-side substitution is particularly important. If a bank requiring high-security facial verification cannot realistically replace the service with an ordinary password system, the two products may not belong to the same relevant market.

Supply-side substitution also matters. A company producing fingerprint sensors may not be capable of quickly entering sophisticated facial-recognition services because it may lack algorithms, training data, regulatory certifications or specialist expertise.

Geographic markets may similarly be national, regional or global depending on procurement requirements, data-localisation rules, certification requirements and customer preferences.

3. Why Biometric Authentication Markets Can Become Concentrated

Data advantages

Biometric systems can improve through access to extensive and diverse datasets. A company possessing unusually large facial, fingerprint or other biometric datasets may therefore enjoy an important competitive advantage.

A new entrant may have good software but insufficient lawful data with which to train, test and improve its system.

This can create a feedback mechanism:

More customers → more usable data and testing opportunities → better technology → stronger reputation → more customers.

Competition authorities must nevertheless examine the facts carefully because possession of a large dataset does not automatically establish dominance.

High technological costs

Developing reliable biometric authentication can require substantial expenditure on artificial intelligence, machine learning, cybersecurity, specialised hardware, testing and regulatory compliance.

High fixed costs can make entry difficult.

Accuracy and reputation

Authentication customers frequently require extremely low error rates. Governments, banks and security-sensitive businesses may therefore prefer established suppliers.

A strong reputation for reliability can operate as another entry barrier.

Switching costs

Changing biometric suppliers may require replacing software, databases, APIs, terminals, sensors and security procedures.

Customers can therefore become technologically dependent on an existing provider.

Intellectual property

Patents, proprietary algorithms, trade secrets and specialised hardware can strengthen legitimate incentives to innovate. However, control over technology that becomes practically indispensable can also affect the ability of competitors to enter or expand.

Government procurement

Governments are major purchasers of biometric technologies for passports, borders, policing and national identity systems.

Long-duration or exclusive contracts can significantly affect market structure, particularly where only a small number of suppliers meet technical qualification requirements.

4. Network Effects and Biometric Data

Traditional network effects arise when a product becomes more valuable as more people use it.

Biometric markets may instead exhibit important data-driven scale effects.

A provider processing large numbers of authentication attempts may gain additional opportunities to evaluate:

• false acceptance rates;
• false rejection rates;
• demographic performance;
• spoofing attempts;
• environmental conditions;
• different devices; and
• unusual authentication patterns.

Large-scale testing may consequently improve the provider's technology.

This does not mean every biometric market inevitably becomes monopolistic. Open standards, interoperability requirements, accessible testing datasets and multi-vendor procurement can reduce these advantages.

5. Abuse of Dominance

Where a biometric provider possesses substantial market power, several practices can attract competition-law scrutiny.

Exclusive dealing

A dominant supplier might require customers to use only its biometric authentication services.

An exclusivity arrangement is not automatically unlawful. Authorities generally examine its duration, market coverage, justification and foreclosure effects.

Tying and bundling

A company controlling a major operating system, cloud platform or identity service might combine that product with its own biometric authentication service.

For example:

Core platform + mandatory proprietary biometric authentication

could disadvantage independent authentication providers if customers cannot practically obtain the products separately.

The competition issue is not bundling itself but whether the arrangement uses market power in one market to exclude effective competition in another.

Refusal to provide interoperability

Biometric systems frequently depend on APIs, technical interfaces and authentication protocols.

A powerful platform could potentially disadvantage competitors by denying or degrading interoperability.

Competition authorities would examine whether access is genuinely indispensable, whether alternative routes exist, and whether the restriction has legitimate security or privacy justifications.

Discriminatory access

A vertically integrated company might provide superior technical access to its own biometric product while imposing worse conditions on competing services.

Such conduct can raise self-preferencing or discriminatory-access questions.

6. Merger Control

Acquisitions are another important source of biometric market concentration.

A transaction can involve:

Biometric company + biometric competitor

or

Large digital platform + biometric company.

Authorities may consider whether the transaction:

• removes an important competitor;
• eliminates a potential future competitor;
• increases barriers to entry;
• combines valuable datasets;
• creates control over important authentication infrastructure;
• enables foreclosure of downstream competitors; or
• increases customer dependence on one ecosystem.

A particularly relevant contemporary example is the proposed acquisition by Amadeus of IDEMIA's relevant identity businesses. In July 2026, the East African Community Competition Authority announced a merger inquiry involving IDEMIA Government USA Corp. and IDEMIA Public Security France SAS. IDEMIA's activities identified by the authority included biometric border, law-enforcement, facial-recognition, fingerprint and access-control technologies. The authority stated that its inquiry would consider whether the transaction could substantially lessen competition or conflict with the public interest.

7. Important Cases and Enforcement Examples

Direct reported antitrust judgments dealing exclusively with "biometric authentication market concentration" remain comparatively limited. It is therefore important not to mischaracterise privacy cases as competition cases. The following authorities illustrate the legal principles surrounding biometric data, facial-recognition technology, market access and regulatory control.

Case 1: Advocate Ramkishan Saraswat v. Secretary, Ministry of Electronics and Information Technology & Others — Competition Commission of India, Case No. 26 of 2026

This is particularly significant because it directly places biometric technology within a competition-law proceeding.

The matter before the Competition Commission of India involved the Ministry of Electronics and Information Technology, the Controller of Certifying Authorities and Precision Biometric India Pvt. Ltd., among other parties.

Competition significance

The case demonstrates that regulatory arrangements surrounding biometric technologies can potentially be examined through competition-law concepts.

When technical approval, certification or regulatory requirements determine which biometric suppliers can participate in a market, competition questions can include:

• whether access conditions are objectively justified;
• whether particular suppliers receive preferential treatment;
• whether certification creates unnecessary entry barriers; and
• whether regulatory arrangements distort the competitive process.

It is therefore highly relevant to the relationship between biometric authentication and market access.

Case 2: Patel v. Facebook, Inc. — Ninth Circuit, 2019

Illinois users alleged that Facebook created facial templates from photographs without satisfying requirements of the Illinois Biometric Information Privacy Act.

The Ninth Circuit concluded that the alleged creation of face templates without consent implicated concrete privacy interests sufficient for Article III standing and upheld class certification.

Competition significance

Patel was not an antitrust decision. Its importance for market-concentration analysis comes from demonstrating the economic and legal significance of biometric datasets.

Competition authorities examining data-intensive markets may consider whether control over difficult-to-replicate datasets contributes to entry barriers or market power.

At the same time, competition remedies cannot simply require unrestricted sharing of biometric information. Privacy law can substantially constrain how such data are collected, transferred and reused.

Case 3: In re Clearview AI Consumer Privacy Litigation / Weissman v. Clearview AI — Seventh Circuit, 2026

Clearview developed facial-recognition technology using images collected from publicly accessible internet sources.

The consolidated litigation included claims involving biometric information and different state privacy and related laws. In July 2026, the Seventh Circuit addressed objections concerning the structure of the class settlement and found a representation problem concerning the allocation of settlement benefits.

Competition significance

Again, this is principally biometric/privacy litigation rather than a conventional monopolisation proceeding.

Its broader relevance is that large-scale collection of facial images can become an important technological input.

From a competition perspective, regulators may ask whether a dataset is:

1. unique;
2. lawfully replicable;
3. expensive to reproduce;
4. necessary for competitive performance; and
5. capable of creating durable entry barriers.

Clearview illustrates why data accumulation can matter when evaluating biometric technology markets.

Case 4: Vance v. Google LLC — U.S. District Court, Northern District of California

The litigation concerned IBM's Diversity in Faces dataset and Google's acquisition and alleged use of the dataset.

The plaintiffs alleged that Google obtained the dataset to improve the fairness and accuracy of its facial-recognition products and make those technologies more commercially valuable. The litigation involved claims under Illinois biometric privacy legislation.

Competition significance

Although this was not an antitrust judgment, it illustrates an important competitive input: training data.

High-quality and diverse datasets can help companies improve algorithmic accuracy.

Competition authorities investigating biometric concentration could consequently examine whether access to training data is reasonably available to competitors or concentrated among a small group of firms.

Case 5: G.T. v. Samsung Electronics America

The dispute concerned facial-recognition functionality in Samsung's photo-gallery application.

In 2026, the Seventh Circuit affirmed dismissal because the complaint did not plausibly establish that Samsung obtained or exercised the required control over the biometric data stored on users' devices for the relevant BIPA claim.

Competition significance

The decision illustrates an important distinction between device-level biometric processing and centralised possession of biometric information.

That distinction can matter considerably in competition analysis.

Where biometric processing occurs locally on a user's device, the provider may not necessarily accumulate the same centralised dataset that could otherwise generate data-based competitive advantages.

Therefore, authorities should not assume that every biometric technology produces identical concentration effects.

Case 6: FTC v. Rite Aid Corporation — Facial Recognition Enforcement

The U.S. Federal Trade Commission brought proceedings concerning Rite Aid's deployment of facial-recognition technology in retail stores.

The settlement prohibited Rite Aid from using facial-recognition technology for security or surveillance purposes for five years and imposed safeguards relating to automated systems using biometric information.

Competition significance

This is principally a consumer-protection and data-governance enforcement matter rather than a monopolisation case.

Nevertheless, it demonstrates that biometric competition does not operate independently of consumer-protection regulation.

A supplier competing through aggressive deployment of biometric technology may face substantial regulatory obligations relating to accuracy, safeguards and consumer harm.

Compliance requirements can therefore influence both competitive conditions and barriers to entry.

Case 7: FTC v. Match Group, Inc. — Facial-Recognition Investigation

In proceedings concerning an FTC civil investigative demand, the underlying investigation related partly to reports concerning a facial-recognition startup and access to images associated with a dating service owned by Match Group.

The federal court proceedings concerned the FTC's investigative authority and the relevant demand.

Competition significance

The matter illustrates another important feature of biometric markets: established digital platforms can possess datasets that are commercially useful to developers of facial-recognition systems.

Access to platform-generated image datasets can therefore affect the development of emerging biometric competitors.

It also demonstrates why regulators increasingly need to consider interactions between platforms, datasets, artificial intelligence and biometric technology.

Case 8: Schottenstein v. Wakefern Food Corp.

This litigation concerned alleged use of facial-recognition technology at Fairway Market stores.

The plaintiff alleged violations of New York City's biometric law together with New York consumer-protection and civil-rights provisions.

Competition significance

The proceeding is not a traditional antitrust case, but it demonstrates how downstream businesses adopting facial recognition must operate within biometric-specific regulatory frameworks.

Such rules affect market demand because purchasers increasingly evaluate not only price and accuracy but also legal compliance, transparency and data governance.

8. Concentration Through Data Accumulation

One of the hardest competition questions is whether biometric data should be treated as an important competitive asset.

Suppose Firm A possesses hundreds of millions of legitimately obtained biometric samples while Firm B possesses a much smaller dataset.

Firm A might develop:

• better recognition accuracy;
• stronger demographic testing;
• improved fraud detection;
• better anti-spoofing systems; and
• stronger commercial credibility.

This advantage may attract additional customers, generating still more opportunities for testing and improvement.

Competition authorities therefore increasingly need to distinguish between legitimate advantages obtained through innovation and advantages maintained through exclusionary control over necessary inputs.

9. Interoperability and Open Standards

Interoperability can reduce concentration.

For example, suppose an organisation's identity-management infrastructure permits authentication only through one supplier's proprietary biometric format.

Changing suppliers could require rebuilding the entire system.

By contrast, interoperable standards may allow customers to replace biometric suppliers while retaining existing infrastructure.

Competition authorities may therefore investigate restrictions involving:

• APIs;
• biometric templates;
• authentication protocols;
• hardware interfaces;
• certification standards; and
• identity-management platforms.

However, mandatory interoperability requires caution because biometric information is highly sensitive. Competition objectives must therefore be reconciled with cybersecurity and privacy requirements.

10. Vertical Integration

Biometric markets increasingly involve vertically integrated technology ecosystems.

Consider:

Device → operating system → secure hardware → biometric sensor → authentication software → identity service → payment application.

A company controlling several layers may legitimately produce a more secure and efficient system.

However, competition concerns can arise if control over one indispensable layer is used to prevent rival biometric providers from competing at another layer.

Authorities therefore examine both the efficiency benefits and possible foreclosure effects of vertical integration.

11. Algorithmic Accuracy as a Competitive Parameter

Competition is not limited to price.

Biometric authentication providers can compete on:

• accuracy;
• authentication speed;
• false-rejection rates;
• false-acceptance rates;
• privacy protection;
• cybersecurity;
• anti-spoofing capability;
• interoperability;
• reliability; and
• ease of integration.

Consequently, a merger between important biometric suppliers could reduce innovation competition even if customers initially experience no price increase.

Loss of independent research programmes may therefore be relevant in merger analysis.

12. Privacy and Competition Law

Privacy can itself operate as a dimension of product quality.

Imagine two facial-authentication services:

Provider A: inexpensive but retains extensive centralised biometric information.

Provider B: more privacy-protective and processes authentication locally.

Consumers or business purchasers may value Provider B's privacy characteristics.

If market concentration eliminates privacy-oriented alternatives, competition may decline even without an immediate increase in monetary prices.

The Patel, Clearview, Vance and Samsung litigation demonstrates why the manner in which biometric information is obtained, controlled and processed is legally significant.

13. Potential Competition

Biometric markets are developing rapidly.

A small company may currently possess only a limited market share while having technology capable of challenging an established supplier.

An acquisition of such a company can therefore raise questions of potential competition.

Authorities may examine:

• the startup's technology;
• patents;
• research pipeline;
• access to customers;
• financing;
• commercialisation plans; and
• realistic prospects of independent expansion.

The objective is to determine whether the transaction eliminates a meaningful future competitive constraint rather than merely acquiring complementary technology.

14. Essential Facilities and Access Issues

In exceptional circumstances, control over indispensable infrastructure may generate access questions.

Suppose a biometric identity infrastructure becomes effectively unavoidable for providing certain services and there is no realistic substitute.

Competition analysis could consider:

1. whether the infrastructure is genuinely indispensable;
2. whether duplication is realistically possible;
3. whether access has been denied;
4. whether denial eliminates effective competition;
5. whether access is technically feasible; and
6. whether security, privacy or other objective justifications exist.

The essential-facilities concept is interpreted narrowly in many jurisdictions, so dominance alone does not create a general obligation to share technology or biometric databases.

15. Remedies

Where authorities establish competitive harm, possible remedies can include:

Structural remedies: divestiture of businesses, assets or technology where necessary in merger cases.

Interoperability remedies: requiring appropriate technical compatibility.

Non-discrimination obligations: preventing a vertically integrated provider from unfairly favouring its own biometric product.

Contractual remedies: limiting anticompetitive exclusivity or tying.

Data-related remedies: carefully designed access or portability measures where legally appropriate.

Data-sharing remedies require particular caution because biometric information cannot simply be treated like an ordinary commercial dataset. Privacy, cybersecurity, consent and data-protection requirements remain applicable.

16. Economic Assessment Framework

A competition authority examining biometric authentication concentration would ordinarily work through several connected questions.

First, it identifies the relevant product and geographic market.

Second, it examines market shares and concentration but does not treat them as the complete analysis.

Third, it investigates barriers to entry, including proprietary datasets, intellectual property, technical certification, switching costs and government procurement requirements.

Fourth, it examines competitive effects such as higher prices, reduced innovation, lower quality, weaker privacy competition or exclusion of competitors.

Fifth, where mergers or restrictive arrangements generate efficiencies, the authority considers substantiated benefits such as better security, greater accuracy, reduced fraud or technological integration.

Finally, remedies must protect competition without unnecessarily weakening cybersecurity, privacy or incentives to innovate.

17. Overall Legal Position

Competition law and biometric authentication increasingly intersect because biometric systems combine data, artificial intelligence, hardware, digital identity infrastructure and platform ecosystems.

The principal competition concerns are not simply that biometric companies become large. The more important questions are whether concentration gives firms durable market power and whether that power is protected or extended through exclusionary practices.

The most significant competition risks include:

data concentration + technological lock-in + high switching costs + proprietary standards + exclusive contracts + vertical integration + acquisition of emerging competitors.

At the same time, large scale can produce genuine benefits. Larger biometric systems may provide better security, greater accuracy, broader testing and substantial research investment. Competition law therefore requires an effects-based assessment rather than assuming that concentration itself is unlawful.

The emerging legal framework shows that biometric market analysis cannot be separated completely from privacy and consumer-protection law. Cases such as Patel v. Facebook, Clearview AI, Vance v. Google, G.T. v. Samsung, FTC v. Rite Aid, FTC v. Match Group, together with competition proceedings involving biometric suppliers, demonstrate different dimensions of control over biometric information and technology.

The central competition-law objective is therefore to preserve contestability: established firms should be able to benefit from legitimate innovation and investment, while competitors should have a realistic opportunity to challenge them without facing artificial exclusionary barriers.

I’ve distinguished the direct competition-law authorities from biometric privacy/consumer cases so the latter are not incorrectly presented as antitrust judgments.