Competition Law and Identity Ecosystems and Market Concentration

1. Introduction

Identity ecosystems are networks through which individuals, businesses, devices, applications, and platforms establish, verify, authenticate, and manage digital identity.

They can include:

digital identity providers;

authentication services;

single-sign-on systems;

government digital-ID infrastructure;

biometric identity systems;

mobile identity services;

payment authentication;

identity verification platforms;

digital wallets;

credential providers;

age-verification systems;

enterprise identity-management services.

From a competition-law perspective, identity ecosystems are important because identity can function as essential infrastructure for accessing digital markets.

If one undertaking controls a critical identity layer, it may gain advantages in adjacent markets. This can produce market concentration, entry barriers, network effects, data advantages, interoperability problems, and exclusionary conduct.

2. Meaning of an Identity Ecosystem

An identity ecosystem can be represented as:

User

↓

Identity Provider

↓

Authentication / Verification

↓

Platform or Application

↓

Digital Service

For example, a user may authenticate through one identity provider to access:

banking;

e-commerce;

social media;

healthcare;

government services;

employment platforms;

cloud applications.

The identity provider can therefore become a gateway between users and multiple downstream markets.

3. Identity as a Competitive Input

Identity is increasingly an economic input.

A platform may need identity services to:

verify customers;

prevent fraud;

comply with regulatory requirements;

authenticate transactions;

establish age;

establish business credentials;

provide personalized services.

Where an identity provider becomes indispensable, it may acquire bottleneck power.

Competition concerns can arise if that provider:

refuses access;

discriminates between competitors;

ties identity services to another product;

uses identity data to enter downstream markets;

prevents interoperability;

imposes exclusivity.

4. Relevant Markets

Several relevant markets may exist.

A. Identity verification market

Providers compete to verify:

individuals;

businesses;

documents;

credentials.

B. Authentication market

Competition may occur between:

passwords;

biometric authentication;

authentication apps;

security keys;

identity platforms.

C. Single-sign-on market

Enterprise users may rely upon a small number of providers.

D. Digital identity infrastructure

A government or private identity network may constitute a separate infrastructure market.

E. Identity-related data services

Providers may offer:

fraud scoring;

risk assessment;

identity intelligence;

customer verification.

Market definition should be based upon substitutability and actual competitive constraints rather than assuming that all identity services constitute one market.

5. Network Effects

Identity ecosystems have strong network effects.

More users → more applications accept the identity → more valuable identity ecosystem → more users.

This can create:

Identity adoption → ecosystem expansion → greater adoption → increased market power.

Network effects can make entry difficult because a new identity provider must persuade:

users to register;

businesses to accept it;

applications to integrate it.

This creates a coordination problem for entrants.

6. Two-Sided and Multi-Sided Markets

Identity platforms frequently operate multi-sided markets.

For example:

Users ↔ Identity provider ↔ Businesses

The platform may need to attract both users and service providers.

Competition analysis therefore needs to consider:

pricing on different sides;

cross-side network effects;

data flows;

switching costs;

interoperability.

A service may even be free to consumers while generating substantial revenue from businesses.

7. Data Advantages

Identity providers can potentially possess valuable information concerning:

authentication activity;

transaction history;

device information;

account relationships;

verification history;

fraud indicators.

Data accumulation can create a feedback loop:

More users → more identity data → better verification → more businesses → more users.

This can reinforce market concentration.

However, possession of large amounts of data is not automatically evidence of dominance or anticompetitive conduct. The analysis must examine whether the data actually creates a durable competitive advantage and whether rivals can obtain substitutes.

8. Switching Costs

Identity systems can generate substantial switching costs.

Users may have:

years of authentication history;

multiple linked accounts;

stored credentials;

business integrations.

Businesses may have:

APIs;

compliance systems;

employee accounts;

customer databases;

security infrastructure.

Consequently, switching identity providers may be expensive.

High switching costs can reduce competitive pressure even when several nominal competitors exist.

9. Interoperability

Interoperability is one of the most important competition issues.

An incumbent identity provider may restrict:

API access;

credential portability;

authentication interoperability;

cross-platform verification.

This can make it difficult for competitors to enter.

An interoperability problem can therefore transform an otherwise competitive identity market into a closed ecosystem.

10. Refusal to Interoperate

Suppose an identity provider controls a critical authentication system and refuses to allow competing applications reasonable interoperability.

Potential competition theories include:

refusal to deal;

denial of market access;

essential-facility-type concerns;

leveraging;

foreclosure.

However, competition law generally requires careful examination of factors such as:

indispensability;

availability of alternatives;

technical feasibility;

legitimate business justification;

competitive effects.

11. Tying and Bundling

A dominant identity provider may bundle identity services with another product.

For example:

"To obtain access to our enterprise software, customers must use our identity service."

Or:

"Applications using our platform must use our authentication system."

Potential concerns include:

foreclosure of competing identity providers;

raising rivals' costs;

leveraging dominance;

reducing consumer choice.

Tying is particularly significant when the identity product functions as an entry point to an adjacent market.

12. Self-Preferencing

An identity provider may operate both:

an identity infrastructure; and

downstream services.

It could potentially favour its own downstream services through:

authentication priority;

default settings;

ranking;

API access;

verification speed;

security privileges.

This resembles the broader competition problem of vertical integration plus gatekeeper control.

13. Exclusive Dealing

An identity provider might require applications to:

use its identity service exclusively;

avoid competing authentication providers;

give it preferred status.

If the provider has substantial market power, extensive exclusivity can potentially foreclose competing identity services.

Relevant factors include:

duration;

market coverage;

switching costs;

availability of alternatives;

importance of the identity service.

14. Identity Ecosystems and Dominance

Market concentration becomes particularly significant where one undertaking controls multiple identity layers.

For example:

Identity → Authentication → Payments → Platform → Advertising

Control over one layer can strengthen control over others.

This creates potential ecosystem dominance.

Competition authorities may therefore need to examine not merely the market share in an identity market but also the undertaking's position across interconnected markets.

15. Indian Competition Law

In India, identity ecosystems can primarily be examined under the Competition Act, 2002.

Section 3

Section 3 addresses agreements that cause or are likely to cause an appreciable adverse effect on competition.

Potentially relevant arrangements include:

exclusive identity agreements;

tying arrangements;

discriminatory access agreements;

coordinated standards;

restrictive interoperability agreements.

Section 4

Section 4 concerns abuse of dominant position.

Potentially relevant conduct includes:

unfair conditions;

discriminatory conditions;

denial of market access;

limiting technical development;

leveraging dominance into another market.

16. Merger Control

Identity ecosystems also raise merger concerns.

A large platform acquiring an identity provider may combine:

user data;

authentication infrastructure;

verification technology;

application distribution;

payment services.

A transaction that appears small based solely on current revenue may nevertheless have strategic importance because the target may provide an important future competitive constraint.

Therefore, merger analysis may need to consider:

data;

innovation;

interoperability;

network effects;

ecosystem effects.

17. Case Law

Case 1: Google Android

The Google Android proceedings provide an important example of ecosystem-based competition analysis.

The European Commission examined Google's contractual arrangements concerning the Android ecosystem, including relationships involving:

mobile operating systems;

app stores;

search;

browser distribution.

Relevance to identity ecosystems

The case illustrates how control over one technological layer can reinforce power in adjacent markets.

An identity provider could similarly leverage control over authentication into:

application distribution;

payments;

cloud services;

advertising;

digital platforms.

The broader lesson is that competition analysis may need to consider the ecosystem rather than an isolated product.

18. Case 2: Google Shopping

In Google Shopping, the European Commission found that Google had systematically favoured its own comparison-shopping service within general search results.

The case is relevant to identity ecosystems because it demonstrates how a dominant infrastructure provider can potentially favour its own downstream service.

Competition significance

An identity platform controlling authentication could potentially favour:

its own applications;

affiliated services;

preferred partners.

This creates a potential self-preferencing theory.

19. Case 3: Microsoft / Commission — Interoperability

The Microsoft competition proceedings are particularly important for identity ecosystems.

The European Commission addressed Microsoft's refusal to provide interoperability information concerning work-group server products.

The case illustrates how control over technical interoperability can create competitive concerns where competitors depend upon compatibility with a dominant platform.

Identity relevance

Authentication systems frequently require interoperability.

A dominant identity provider that prevents competing services from functioning with its infrastructure could raise similar questions.

The case therefore demonstrates the importance of technical interoperability as a competition issue.

20. Case 4: Microsoft Internet Explorer

The Microsoft Internet Explorer proceedings concerned the tying of Internet Explorer to the Windows operating system.

The European Commission found competition concerns relating to the combination of Microsoft's dominant operating-system position with its browser.

Identity relevance

The same conceptual framework can be relevant where:

Dominant platform + identity service

are bundled in a way that disadvantages competing identity providers.

For example, if a dominant operating system required applications to use its proprietary authentication system, competition authorities could examine whether the arrangement foreclosed rival authentication services.

21. Case 5: Bronner v Mediaprint

In Oscar Bronner GmbH & Co. KG v Mediaprint, CJEU, Case C-7/97, the Court examined refusal to provide access to a newspaper distribution system.

The Court adopted a demanding approach to refusal-to-deal claims and considered factors such as indispensability and the absence of realistic alternatives.

Identity relevance

An identity infrastructure might become economically indispensable in a particular ecosystem.

Bronner is therefore important when analysing whether a dominant identity provider can be legally required to provide interoperability or access.

The mere fact that an identity system is commercially important would not automatically establish an obligation to deal.

22. Case 6: IMS Health

In IMS Health GmbH & Co. OHG v NDC Health GmbH & Co. KG, CJEU, Joined Cases C-418/01, the Court considered refusal to license intellectual property and the circumstances in which access to a protected system could become competition-law relevant.

Identity relevance

Identity systems can involve:

proprietary technology;

authentication protocols;

databases;

intellectual property.

IMS Health provides an important framework for examining whether refusal to provide access to a proprietary identity infrastructure can produce competition concerns.

23. Case 7: Slovak Telekom

Slovak Telekom a.s. v European Commission, CJEU, Joined Cases C-165/19 P and C-166/19 P, involved access to telecommunications infrastructure and exclusionary conduct.

The case is useful because digital identity infrastructure can similarly become an upstream input into downstream services.

Relevance

A dominant identity provider could potentially restrict competitors' access to:

authentication infrastructure;

APIs;

verification services.

Slovak Telekom therefore provides useful principles for analysing infrastructure-based foreclosure.

24. Case 8: Apple v Pepper

In Apple Inc. v. Pepper, the U.S. Supreme Court addressed Apple's role in the App Store marketplace.

The case is important for understanding platform intermediation and the relationship between a platform operator and businesses/users dependent on the platform.

Identity relevance

An identity provider can occupy a similar intermediary position:

User → identity layer → application/service.

If access to consumers becomes dependent upon one identity ecosystem, platform power can affect competition in downstream markets.

25. Case 9: United Brands

United Brands v Commission, CJEU, Case 27/76, is a foundational abuse-of-dominance decision.

The case established important principles concerning:

dominance;

market power;

abusive conduct;

discriminatory conditions.

Identity relevance

A dominant identity provider could potentially face Article 102-type concerns if it imposes discriminatory conditions on competing applications or businesses.

The case is therefore relevant to the broader principle that dominant undertakings have particular responsibilities concerning their market conduct.

26. Identity Data as a Competitive Moat

An identity ecosystem can develop a powerful data moat.

Consider:

10 million users

↓

Millions of authentication events

↓

Fraud-detection data

↓

Improved verification

↓

More businesses adopt system

↓

More users join

This feedback mechanism can reinforce concentration.

The competition question is whether competitors can obtain comparable inputs through:

alternative datasets;

interoperability;

open standards;

consumer portability;

independent verification.

27. Credential Portability

A particularly important competition issue is portability.

If consumers can easily transfer their identity credentials between providers, switching becomes easier.

If credentials are locked into one ecosystem, switching costs increase.

Competition authorities may therefore examine whether:

users can export credentials;

businesses can migrate accounts;

authentication history is portable;

APIs permit interoperability.

28. Digital Identity Standards

Standards can have both positive and negative competitive effects.

Pro-competitive effects

Common standards can:

reduce switching costs;

improve interoperability;

facilitate entry;

increase security;

reduce duplication.

Anticompetitive risks

A dominant firm or group of firms might use standards to:

exclude rivals;

control technical specifications;

restrict interoperability;

disadvantage alternative technologies.

Competition law must therefore distinguish open standardization from strategic standard-setting designed to exclude competitors.

29. Identity and Authentication Gatekeepers

An identity provider can become a gatekeeper if applications cannot realistically reach consumers without its authentication mechanism.

Examples might include:

mobile-device authentication;

enterprise identity;

app-store credentials;

payment authentication.

Once identity becomes a gateway, the provider may influence competition in downstream markets.

30. Identity Ecosystems and Platform Lock-In

Lock-in may occur through:

stored credentials;

reputation;

verified status;

account history;

customer relationships;

loyalty programmes;

technical integration.

The greater the lock-in, the less effective ordinary price competition may become.

Competition authorities may therefore consider non-price competition.

31. Privacy and Competition

Identity markets have a special feature: consumers may pay with data rather than money.

A service may be "free" while collecting extensive identity information.

Competition analysis may therefore consider:

privacy quality;

data collection;

data portability;

security;

consumer control.

A reduction in privacy or security can potentially form part of the competitive assessment where competition authorities recognize these as dimensions of product quality.

32. Identity and Personalized Pricing

Identity systems can facilitate personalized pricing because providers can associate transactions with individual accounts.

A platform could theoretically use identity information to distinguish:

new users;

returning users;

high-value consumers;

low-price-sensitive consumers.

Personalized pricing is not automatically anticompetitive.

However, a dominant undertaking using identity data to exploit or exclude customers could raise competition concerns depending upon the conduct and applicable legal framework.

33. Identity-Based Discrimination

An identity provider may potentially provide different access conditions to:

affiliated businesses;

independent businesses;

competitors;

preferred partners.

For example:

Affiliate receives instant verification, while competing application faces delayed verification.

Such conduct could become relevant where the identity provider possesses significant market power and the discrimination disadvantages competing businesses.

34. Identity Ecosystems and Artificial Entry Barriers

New entrants may face several barriers simultaneously:

technical integration costs;

regulatory compliance;

user acquisition;

trust;

security investment;

network effects;

credential portability problems.

Consequently, a market can have only a few providers even without an explicit exclusionary agreement.

Competition authorities must distinguish natural scale economies from artificial barriers created by restrictive conduct.

35. Remedies

Possible competition remedies include:

Interoperability

Require reasonable technical interoperability.

Data portability

Allow users or businesses to transfer relevant information.

Non-discrimination

Prevent discriminatory access conditions.

API access

Require access to critical interfaces under appropriate conditions.

Separation

In extreme circumstances, structural separation may be considered.

Conduct commitments

Platforms may voluntarily modify:

exclusivity provisions;

authentication requirements;

data practices;

interoperability restrictions.

36. Competition Compliance for Identity Providers

Identity providers should establish:

Market-power assessment

Interoperability review

Non-discrimination policy

Data-use restrictions

API-access procedures

Competitor-access review

Tying and bundling assessment

Exclusivity review

Merger-control analysis

Algorithmic and technical audit

37. Competition Assessment Framework

A practical framework is:

Step 1 — Identify the identity layer

Authentication, verification, credentials, identity data, etc.

Step 2 — Define the market

Determine relevant product and geographic markets.

Step 3 — Measure market power

Examine:

market shares;

network effects;

switching costs;

data;

interoperability.

Step 4 — Identify conduct

Look for:

tying;

bundling;

exclusivity;

refusal to interoperate;

discrimination;

self-preferencing.

Step 5 — Examine foreclosure

Ask:

Can rivals realistically compete without access to the identity ecosystem?

Step 6 — Examine efficiencies

Consider:

security;

fraud prevention;

consumer convenience;

innovation;

technical efficiency.

Step 7 — Assess remedies

Determine whether interoperability or portability can restore effective competition.

38. Relationship Between Identity and Ecosystem Power

The central economic relationship can be expressed as:

Identity control

↓

User authentication

↓

Access to applications

↓

Accumulation of data

↓

Network effects

↓

Higher switching costs

↓

Greater ecosystem power

↓

Potential market concentration

This is why identity should not always be treated as merely a technical service.

39. Key Competition-Law Principles

The principal principles are:

Identity infrastructure can constitute an important competitive input.

Network effects can reinforce concentration.

Interoperability can materially affect market entry.

Data advantages can strengthen incumbent positions.

Tying identity services to other products can raise foreclosure concerns.

Exclusivity can increase switching costs and restrict rival access.

Self-preferencing can become relevant where the identity provider also competes downstream.

Refusal to interoperate requires careful analysis of indispensability and alternatives.

Market concentration alone does not establish an infringement.

Legitimate security and fraud-prevention objectives must be distinguished from exclusionary conduct.

40. Conclusion

Identity ecosystems and market concentration represent an increasingly important area of competition law because digital identity can function as a gateway infrastructure connecting users to numerous downstream markets.

The competitive risks arise not simply from a large identity provider but from the interaction of:

network effects + data + switching costs + interoperability + vertical integration + platform power.

The cases involving Microsoft, Google, Bronner, IMS Health, Slovak Telekom, Apple and United Brands provide important legal principles for analysing these issues, even though several arose in adjacent technological or infrastructure markets rather than identity services specifically.

For India, Sections 3 and 4 of the Competition Act, 2002 provide the principal framework. Section 3 can address restrictive agreements and vertical arrangements, while Section 4 becomes particularly relevant where an identity provider possesses substantial market power and uses that position to impose discriminatory conditions, deny market access, tie products, or otherwise restrict competition.

The central competition-law challenge is therefore to preserve the legitimate benefits of secure, interoperable and trusted digital identity while preventing control over identity infrastructure from becoming a mechanism for foreclosing competitors or entrenching ecosystem-wide market concentration.