Competition Law And Biometric Identity Infrastructure Dominance

Competition Law And Biometric Identity Infrastructure Dominance

1. Introduction

Biometric identity infrastructure refers to technological systems that identify or authenticate individuals through biological or behavioural characteristics. Common examples include facial recognition, fingerprints, iris recognition, voice recognition, palm scans, and other biometric identifiers.

Competition-law concerns arise when control over biometric databases, identification technology, authentication standards, or access infrastructure becomes concentrated in one or a small number of undertakings. The issue is particularly important because biometric identity systems can have strong network effects, economies of scale, data advantages, interoperability problems, and high switching costs.

A dominant biometric provider may therefore become more than an ordinary technology supplier. It can potentially operate as an important gateway between individuals and services such as digital payments, banking, workplaces, government services, security systems, online platforms, and digital authentication.

Competition law does not prohibit a company merely because it is large or dominant. The central question is whether the undertaking possesses substantial market power and abuses that position, enters anticompetitive agreements, or participates in a transaction likely to substantially restrict competition.

There is not yet a large body of decided antitrust cases dealing specifically with dominance in biometric identity infrastructure. Consequently, the legal framework is best understood through a combination of biometric litigation and established competition cases concerning data, digital platforms, interoperability, access to infrastructure, tying, and network effects.

2. Relevant Markets in Biometric Identity Infrastructure

The first competition-law question is defining the relevant market.

A biometric ecosystem can contain several separate markets, including:

• biometric identification software;
• facial-recognition services;
• biometric databases;
• biometric authentication services;
• identity-verification platforms;
• fingerprint or iris-recognition technology;
• biometric hardware;
• digital identity infrastructure;
• identity verification APIs; and
• biometric services supplied to governments or enterprises.

Demand-side substitution is especially important. Facial recognition, for example, may not always be interchangeable with passwords, physical identification cards, fingerprints, or iris scanning.

Competition authorities may therefore identify relatively narrow technology markets where customers cannot realistically replace one biometric technology with another.

Geographic markets can also differ. Government procurement may produce national markets, while cloud-based identity-verification platforms may operate internationally.

3. How Dominance Can Develop

A. Large Biometric Databases

The accuracy and usefulness of some biometric systems may improve when the provider possesses access to large quantities of images, identity records, or other training data.

A company possessing a uniquely extensive biometric dataset may therefore obtain an advantage that competitors cannot easily reproduce.

This creates a potential data barrier to entry.

B. Network Effects

More customers can produce more data, which can improve the technology and attract still more customers.

The cycle can become:

More users → more biometric data → better system → more customers → more data.

Network effects can therefore reinforce an incumbent's position.

C. Switching Costs

Organisations integrating biometric authentication into thousands or millions of accounts may face substantial technical and financial costs when moving to another provider.

Switching may require replacing software, retraining systems, migrating databases, changing hardware, obtaining regulatory approvals, and rebuilding integrations.

D. Standards and Interoperability

Dominance can also develop where one company controls technical standards or interfaces necessary for biometric authentication.

Competitors may depend upon access to APIs, operating systems, identity databases, devices, or verification networks controlled by another undertaking.

E. Government Contracts

Large government contracts can have particularly significant competitive consequences.

Winning a nationwide biometric identity project can provide a supplier with enormous scale, technical experience and datasets that smaller competitors may find difficult to reproduce.

4. Abuse of Dominance

Dominance itself is generally lawful. Competition law focuses on abusive conduct.

Refusal to Supply

A dominant biometric infrastructure operator could potentially restrict competition by refusing access to infrastructure that downstream competitors genuinely require.

The analysis would normally consider whether the requested input is indispensable, whether viable alternatives exist, and whether refusal is capable of eliminating effective downstream competition.

Discriminatory Access

Another concern arises where a vertically integrated identity provider gives preferential access to its own products.

For example, competitors might receive slower, more expensive or technically restricted API access.

Competition authorities could examine whether equivalent transactions are being treated differently without objective justification.

Tying

A company could potentially link biometric authentication to another dominant product.

For example:

Identity verification + payment services

or

Operating system + proprietary biometric authentication

Customers might effectively have to obtain the secondary service to use the primary infrastructure.

Where legal requirements are satisfied, such arrangements can raise tying or leveraging concerns.

Exclusive Agreements

Long-term exclusive contracts with governments, banks, airports, retailers, employers, or telecommunications providers can potentially prevent rival biometric suppliers from obtaining sufficient customers to compete effectively.

The existence of exclusivity alone does not automatically establish illegality. Duration, market coverage, competitive alternatives, efficiencies and foreclosure effects would need examination.

5. Important Case Laws and Enforcement Precedents

Case 1: Meta Platforms Inc. and Others v Bundeskartellamt — C-252/21

This 2023 judgment of the Court of Justice of the European Union is particularly important for understanding the relationship between market dominance and personal-data processing.

The dispute developed from the German competition authority's investigation of Facebook's collection and combination of user information.

The Court confirmed that, when examining abuse of dominance, a competition authority can consider compliance with data-protection rules where this is necessary for its competition assessment, while respecting the responsibilities of data-protection authorities.

The Court also addressed the significance of dominance when determining whether consent has genuinely been freely given.

Importance for biometric identity infrastructure

The reasoning is highly relevant where a dominant biometric platform requires individuals to accept extensive biometric-data processing as a condition for accessing an important digital service.

It demonstrates that privacy, data protection and competition law can interact rather than necessarily operating as completely isolated legal regimes.

Case 2: Thornley v Clearview AI, Inc. — Seventh Circuit, 2021

Clearview developed facial-recognition technology based on photographs collected from publicly accessible internet sources.

The litigation described Clearview's system as extracting biometric facial scans and associated information from online photographs and placing that information into a searchable database containing billions of entries.

The particular appellate issue concerned federal standing rather than antitrust liability.

Nevertheless, the case is important for competition analysis because it illustrates how a massive biometric database can become a commercially valuable technological asset.

Competition significance

A facial-recognition database can potentially operate as an important competitive input.

Where reproducing such a database is extremely expensive, legally constrained, or practically impossible, control over it may create substantial barriers to entry.

The case therefore provides useful factual context for analysing data-driven competitive advantages in biometric markets.

Case 3: In re Clearview AI, Inc. Consumer Privacy Litigation

The consolidated litigation concerned Clearview's collection, storage and use of biometric facial information obtained from online photographs.

In March 2025, the federal district court approved a class settlement after several years of litigation. The court described how Clearview created a very large biometric database and supplied facial-recognition functionality, particularly to law-enforcement agencies and retailers.

Again, the litigation primarily concerned biometric privacy rather than monopolisation.

Competition significance

The litigation illustrates several characteristics capable of producing concentration:

Data scale: an enormous collection of facial images.

Algorithmic infrastructure: technology allowing uploaded photographs to be compared against the database.

Dataset advantage: a new entrant may require access to comparable quantities of data to provide equivalent functionality.

Consequently, biometric datasets can potentially function as strategic competitive assets and create barriers to entry.

Case 4: American Civil Liberties Union v Clearview AI

The litigation alleged violations of Illinois's Biometric Information Privacy Act arising from Clearview's collection of facial information.

The dispute ended with a 2022 consent order that significantly restricted Clearview's ability to make its facial-recognition database available to most private businesses in the United States.

Competition relevance

This matter demonstrates that privacy regulation can influence the competitive structure of biometric markets.

A company's competitive advantage cannot automatically be evaluated independently from the legality of the method through which its biometric database was accumulated.

Competition authorities examining barriers to entry may therefore need to distinguish between:

lawfully acquired scale advantages

and

advantages associated with practices restricted by privacy or data-protection law.

This distinction becomes especially important where access to data determines the ability of competitors to enter the market.

Case 5: Google Shopping — Case C-48/22 P / Earlier EU Proceedings

Although Google Shopping does not concern biometrics, it provides an important competition-law analogy for vertically integrated biometric infrastructure.

The European competition proceedings concerned Google's treatment of its own comparison-shopping service relative to competing comparison-shopping services in general-search results.

The broader principle is relevant where an undertaking controls an important digital gateway while simultaneously competing in services that depend upon that gateway.

Application to biometrics

Imagine a company controlling a widely used biometric authentication layer while also selling downstream banking-verification services.

Competition concerns could arise if it provided its own downstream service with superior access while making rival providers use less favourable interfaces.

The biometric context could therefore generate self-preferencing or discriminatory-access theories similar to those encountered in digital-platform competition law.

Case 6: Microsoft Corp. v Commission — Case T-201/04

The Microsoft litigation provides an important precedent concerning interoperability and dominance in technology markets.

The European Commission found competition concerns relating, among other matters, to Microsoft's refusal to provide certain interoperability information needed by competitors in the work-group server operating-system market.

The General Court substantially upheld the Commission's decision.

Application to biometric infrastructure

Interoperability can be equally important for biometric identity systems.

Suppose a dominant biometric provider controls technical information required for competing authentication applications to communicate with its infrastructure.

Restricting interoperability could:

• increase switching costs;
• prevent multi-provider systems;
• disadvantage downstream competitors;
• strengthen ecosystem lock-in; and
• preserve the incumbent's market position.

Microsoft therefore provides an important analytical framework for biometric interoperability disputes.

Case 7: IMS Health GmbH & Co. OHG v NDC Health GmbH & Co. KG — C-418/01

IMS Health concerned access to a copyrighted structure used for presenting pharmaceutical sales information.

The Court examined circumstances in which refusal by a dominant undertaking to license intellectual property could constitute abuse.

The case established demanding requirements and demonstrated that compulsory access is exceptional.

Application to biometric identity infrastructure

Suppose a biometric company controls a proprietary database architecture, biometric template system, authentication protocol or indispensable technical interface.

A competitor cannot simply demand access because the infrastructure would make competition easier.

Questions would include whether the input is genuinely indispensable, whether substitutes exist, whether refusal prevents the emergence of relevant competition, and whether objective justification exists.

IMS Health therefore provides an important limitation on overly broad essential-facility arguments.

Case 8: Slovak Telekom v European Commission — C-165/19 P

The case concerned conduct by a dominant telecommunications undertaking relating to access to infrastructure.

It is useful because it helps distinguish traditional refusal-to-deal situations from situations where access exists but is provided under allegedly unfair or restrictive conditions.

Biometric relevance

A biometric infrastructure operator might technically provide access to competitors while imposing:

• excessive integration requirements;
• discriminatory technical standards;
• restrictive contractual conditions;
• delayed verification responses; or
• commercially disadvantageous access terms.

Competition analysis would therefore look beyond the simple question of whether access technically exists and examine the actual nature of the allegedly exclusionary conduct.

6. Data as a Source of Biometric Market Power

Biometric markets make the relationship between data and market power especially significant.

Ordinary personal data can sometimes change over time. Biometric characteristics, however, can be comparatively persistent identifiers.

A sufficiently large biometric dataset may help an undertaking improve matching accuracy and develop more effective identification services.

This can create a feedback loop:

Large database
↓
More effective identification
↓
More customers
↓
More usage/data
↓
Improved technology
↓
Higher barriers to entry

Competition authorities nevertheless cannot assume that possessing large quantities of data automatically creates dominance.

They must investigate whether competitors can obtain alternative datasets, whether synthetic or licensed data provides meaningful substitutes, whether technological innovation reduces the importance of scale, and whether customers can realistically switch providers.

7. Essential Facilities Doctrine

A particularly difficult issue concerns whether biometric infrastructure could constitute an essential facility.

Suppose a national biometric authentication network becomes the principal method through which banks authenticate customers.

Fintech companies might need access to that infrastructure to compete.

Competition concerns become stronger where:

1. the infrastructure is controlled by a dominant undertaking;
2. competitors cannot realistically duplicate it;
3. access is necessary to compete in a downstream market;
4. access is refused or supplied on exclusionary terms; and
5. no adequate objective justification exists.

However, competition law generally sets a high threshold before forcing one undertaking to provide competitors with access to its assets.

8. Biometric Standards and Competition

Technical standards are extremely important.

Biometric systems may require common specifications governing:

• biometric templates;
• facial-image formats;
• fingerprint records;
• authentication protocols;
• security requirements;
• API communication;
• identity credentials; and
• cross-platform verification.

Open standards can facilitate entry because different providers can communicate with the same ecosystem.

Closed standards can sometimes improve security or system integrity, but they can also create competitive lock-in.

Competition authorities therefore need to distinguish genuine security requirements from restrictions that unnecessarily exclude competitors.

9. Merger Control

Biometric identity markets can also raise merger-control concerns.

Consider:

Large cloud platform + biometric authentication company

or

Major identity database + facial-recognition developer.

The transaction might combine complementary assets that competitors cannot easily reproduce.

Authorities could examine whether the transaction would give the merged entity:

• control over important biometric datasets;
• superior computing infrastructure;
• control over authentication standards;
• access to major distribution channels;
• stronger network effects;
• ability to foreclose competing biometric companies; or
• incentives to restrict interoperability.

Acquisitions of small but innovative biometric companies may also require examination where the target represents an important emerging competitive constraint.

10. Public Procurement and Biometric Dominance

Government procurement deserves particular attention because governments may become the largest purchasers of biometric identification technology.

Authorities should consider whether procurement structures unnecessarily favour incumbents through requirements that only an established supplier can satisfy.

Long contracts can also contribute to market foreclosure.

Potential competition-enhancing approaches include interoperability requirements, transparent technical specifications, reasonable contract durations and data-portability mechanisms, provided these measures remain compatible with cybersecurity and privacy requirements.

11. Privacy Law and Competition Law

Biometric identity infrastructure sits at the intersection of several regulatory fields:

Competition law protects competitive market structures.

Data-protection law regulates processing of personal and biometric information.

Consumer-protection law addresses deceptive or unfair commercial practices.

AI regulation may impose requirements relating to automated biometric technologies.

Cybersecurity regulation protects identity databases from compromise.

The Meta Platforms v Bundeskartellamt judgment demonstrates particularly clearly that these areas can interact. A competition authority may need to understand data-protection requirements when determining whether conduct by a dominant digital undertaking constitutes abuse.

12. Additional Biometric Enforcement Context

The FTC's proceedings involving IntelliVision Technologies provide another useful example of regulatory scrutiny of facial-recognition systems. The FTC challenged claims concerning the accuracy and absence of demographic bias in the company's facial-recognition technology.

This was a consumer-protection proceeding rather than a monopolisation case, so it should not be described as an antitrust precedent. Nevertheless, it demonstrates that biometric competition occurs within a broader regulatory environment where claims about technological performance may themselves receive scrutiny.

Similarly, the FTC's proceedings involving Rite Aid concerned its deployment of facial-recognition technology in retail stores. The resulting order restricted its use of facial recognition for security or surveillance for five years and required safeguards concerning automated systems using biometric information. Again, this is primarily a consumer-protection matter rather than a dominance decision.

13. Competition-Law Assessment Framework

A regulator investigating biometric identity infrastructure dominance could generally proceed through the following framework.

Step 1 — Define the relevant market

Determine which biometric products or authentication technologies are realistic substitutes.

Step 2 — Determine market power

Examine market shares, entry barriers, customer dependency, network effects, data advantages and switching costs.

Step 3 — Identify the conduct

Determine whether the concern involves refusal of access, discrimination, tying, exclusivity, self-preferencing, interoperability restrictions or another practice.

Step 4 — Determine foreclosure effects

Assess whether equally efficient or otherwise meaningful competitors are prevented from reaching customers, infrastructure or essential inputs.

Step 5 — Examine objective justification

Security, fraud prevention, cybersecurity, privacy protection and technical integrity can provide legitimate explanations for restrictions.

Step 6 — Examine proportionality

Even a legitimate objective does not necessarily justify every restriction. Authorities may examine whether less restrictive alternatives could achieve the same legitimate purpose.

Step 7 — Design remedies

Possible remedies can include interoperability obligations, non-discrimination requirements, contractual changes, restrictions on exclusivity, data-portability mechanisms or structural measures in exceptional circumstances.

14. Major Case-Law Principles

The cases discussed above can be organised into several useful principles:

15. Conclusion

Biometric identity infrastructure presents an important emerging area for competition law because control over identity data, algorithms, authentication networks, standards and interfaces can produce substantial and durable market power.

The strongest competition concerns arise where these advantages become self-reinforcing. A provider controlling a large biometric dataset may obtain better technology and more customers, generating additional scale and making entry increasingly difficult.

Competition law nevertheless should distinguish dominance from abuse. Large datasets, advanced technology and successful biometric platforms are not inherently unlawful.

Intervention becomes relevant when market power is combined with conduct such as exclusionary refusals, discriminatory access, anticompetitive tying, foreclosure through exclusivity, unjustified interoperability restrictions or other practices capable of protecting dominance by weakening effective competition.

Existing decisions involving Meta, Microsoft, IMS Health and digital-platform markets supply the principal competition-law doctrines, while the Clearview litigation demonstrates the distinctive economic and regulatory characteristics of biometric databases.

Accordingly, biometric identity infrastructure dominance should be analysed as a combination of traditional abuse-of-dominance principles and modern data-driven market characteristics, with particular attention to data concentration, interoperability, network effects, switching costs, privacy regulation and access to strategically important identity infrastructure.

Reorganize the case-law sectionSeparate binding cases from analogies

Reorganize the case-law section

Separate binding cases from analogies

Reduce repeated Clearview discussion