Identity Resolution Systems And Cross-Platform Tracking Control

1. Introduction

Identity resolution systems are technological systems that attempt to determine that multiple identifiers, devices, accounts, browsers, applications, locations, or behavioural records belong to the same person, household, organisation, or device environment.

Examples include:

• matching an email address with a mobile advertising ID;
• linking a browser cookie to an app account;
• connecting a person's activity across websites and devices;
• matching hashed telephone numbers across platforms;
• combining login information, device fingerprints, IP addresses and behavioural signals;
• resolving customer identities across advertising, e-commerce, payment and social-media ecosystems.

These systems can create substantial commercial efficiencies because they allow businesses to provide authentication, fraud prevention, attribution, personalisation and advertising measurement. However, where a dominant platform controls the principal identity layer, identity resolution can become an infrastructure of cross-platform tracking and a source of market power.

The competition-law concern is therefore not simply the collection of data. The deeper question is:

Can control over the technical capability to resolve identities across otherwise separate digital environments allow a dominant undertaking to exclude rivals, increase switching costs, foreclose competing advertising or data services, or entrench its ecosystem?

There is no single leading case specifically titled "identity resolution systems." The legal principles emerge from cases involving data combination, tracking, privacy-competition interactions, interoperability, tying, platform ecosystems, and access to competitively significant data.

2. Meaning of Identity Resolution

An identity-resolution system generally performs five stages:

A. Identifier collection

The system collects identifiers such as:

• account IDs;
• email addresses;
• telephone numbers;
• cookies;
• advertising IDs;
• device IDs;
• IP addresses;
• login credentials;
• biometric or behavioural identifiers.

B. Identifier matching

The system determines whether two or more identifiers probably relate to the same entity.

For example:

user@example.com → mobile device → browser → application account → purchase history.

C. Identity graph construction

The matched information can form an identity graph.

A simplified structure is:

Person → Account A → Device 1 → Browser → App B → Purchase C → Advertising ID

The larger the graph, the more accurately the operator may be able to recognise the same user across environments.

D. Cross-platform enrichment

Information obtained from one service can be combined with information from another.

For example:

Social-media activity + search activity + shopping activity + app usage

may produce a considerably richer behavioural profile than any individual service could generate alone.

E. Commercial activation

The resolved identity can then be used for:

• targeted advertising;
• attribution;
• retargeting;
• audience segmentation;
• fraud detection;
• recommendation;
• credit or risk assessment;
• customer analytics;
• measurement;
• personalised pricing.

3. What Is Cross-Platform Tracking Control?

Cross-platform tracking control exists where an undertaking possesses substantial ability to determine whether, how, and under what conditions user activity can be linked across independent digital services.

The controlling undertaking may determine:

1. which identifiers are recognised;
2. which platforms can exchange identifiers;
3. whether third parties may access the identity graph;
4. which APIs are available;
5. whether tracking technologies are permitted;
6. whether rival advertising services can perform attribution;
7. whether users can opt out;
8. whether identity information may be combined;
9. whether competing platforms can interoperate.

This can transform identity resolution from an ordinary technical service into a strategic bottleneck.

4. Competition-Law Theory

A. Identity as an input

Identity information may become a competitively important input for:

• online advertising;
• ad measurement;
• attribution;
• fraud prevention;
• customer acquisition;
• recommendation systems.

A dominant undertaking that controls this input may possess an advantage over competitors.

B. Data-network effects

Identity resolution can create powerful feedback effects.

More users

↓

More identifiers

↓

Better identity matching

↓

Better targeting and measurement

↓

More advertisers and commercial partners

↓

More data

↓

Even stronger identity resolution

This creates a data-network effect.

5. Identity Resolution as an Entry Barrier

A new advertising or analytics platform may technically be able to enter the market but still lack sufficient identity information.

Suppose Platform A has:

• 500 million authenticated users;
• extensive browsing data;
• application data;
• purchase data;
• device information.

Platform B has only:

• 5 million users;
• limited first-party information;
• no ability to resolve users outside its own service.

Even if Platform B offers superior advertising technology, it may be unable to achieve comparable targeting or measurement.

The competitive problem is therefore not merely "who has more data."

It is:

Who has the ability to connect data belonging to the same user across different environments?

6. Identity Resolution and Ecosystem Lock-In

Identity systems can make switching more difficult.

Consider:

Identity → reputation → transaction history → recommendations → payment credentials → social connections → subscriptions

If all these attributes are attached to one dominant identity account, moving to a rival platform may require rebuilding the user's digital identity from zero.

This produces identity lock-in.

The user may remain with the dominant platform even where the competing service is objectively better because leaving means losing:

• history;
• reputation;
• contacts;
• personalised recommendations;
• account authentication;
• loyalty benefits;
• stored preferences.

7. Cross-Platform Tracking and Advertising Markets

Identity resolution is particularly significant in digital advertising.

Advertising markets depend on three interconnected capabilities:

1. Audience identification

Who is the user?

2. Audience prediction

What is the user likely to do?

3. Audience activation

Can an advertiser reach that user?

A dominant identity-resolution provider can potentially control all three.

This may allow it to:

• favour its own advertising services;
• restrict competing trackers;
• deny competitors access to identifiers;
• impose discriminatory API conditions;
• limit third-party measurement;
• degrade rival attribution systems.

8. Self-Preferencing

A platform controlling identity infrastructure could potentially give its own downstream services preferential access.

For example:

Dominant platform's identity system

→ full identity matching for its advertising business

but

Independent advertising exchange

→ limited or delayed matching.

This could constitute an important form of self-preferencing if the conduct satisfies the relevant abuse-of-dominance requirements.

The competitive harm is especially serious where the identity layer functions as an unavoidable gateway to advertising demand or supply.

9. Refusal to Interoperate

Another possible theory is refusal to provide interoperability.

A dominant identity provider might refuse to allow rivals to:

• authenticate users;
• match identifiers;
• perform conversion measurement;
• transfer identity information;
• use standard APIs.

Competition law may become relevant where access is indispensable and the legal conditions for an abusive refusal to deal or essential-facility-type theory are satisfied.

However, not every refusal to share data is unlawful.

Courts generally balance competition concerns against:

• privacy;
• security;
• intellectual-property rights;
• investment incentives;
• technical feasibility;
• legitimate business justification.

10. Privacy and Competition Are Interconnected

One of the most important developments in this area is the recognition that privacy conditions can have competitive significance.

A platform may provide a service for "free" while extracting extensive personal information.

The relevant competitive variable therefore may not be:

price alone.

Instead, competition may involve:

• quantity of data collected;
• quality of privacy;
• degree of tracking;
• ability to control data combination;
• transparency;
• user choice.

A deterioration in privacy can potentially constitute a non-price dimension of competition.

11. Six Major Case Laws

Case 1 — Bundeskartellamt v Facebook / Meta Platforms (Germany)

Facts

The German Federal Cartel Office examined Facebook's practice of combining data collected from different sources, including Facebook services and third-party websites and applications.

The central concern was that Facebook's strong market position could allow it to impose extensive data-combination practices on users.

Legal significance

The case is exceptionally important for identity-resolution theory because it demonstrated that:

The combination of information from multiple digital environments can itself have competition-law significance.

The German authority treated privacy-related conditions as potentially connected with Facebook's market power.

The case illustrates how a dominant platform can use its ecosystem to create a comprehensive profile that independent competitors cannot easily reproduce.

Relevance

It provides a strong conceptual foundation for analysing:

• identity graphs;
• cross-platform tracking;
• data combination;
• ecosystem dominance;
• privacy as a competitive parameter;
• user dependency.

Case 2 — European Commission v Google Android

Facts

The European Commission investigated Google's conduct concerning Android, including arrangements involving Google Search, the Play Store and browser applications.

Legal significance

The case demonstrates how control over one layer of a digital ecosystem can be leveraged into adjacent markets.

Although Android was not itself an identity-resolution case, the underlying principle is relevant:

Control over an important technological gateway can facilitate the extension of market power into neighbouring services.

An operating-system or platform layer may influence:

• application access;
• advertising identifiers;
• authentication;
• tracking permissions;
• default services.

Relevance to identity resolution

A dominant operating-system provider may potentially control the conditions under which third-party applications obtain access to identifiers and tracking capabilities.

The Android decision therefore provides an important framework for analysing ecosystem-level leveraging.

Case 3 — Google Search (Shopping)

Facts

The European Commission found that Google had abused its dominant position by systematically favouring its comparison-shopping service in general search results.

Legal significance

The case established an important principle concerning the use of dominance in one market to favour a related service.

Application to identity systems

Suppose an undertaking controls:

Identity infrastructure

and operates:

Advertising / analytics / measurement services.

If the identity infrastructure is used to favour the undertaking's own downstream service while disadvantaging competitors, a comparable leveraging theory could arise.

The relevant question becomes whether identity-control rules:

• distort access;
• discriminate against rivals;
• reduce effective competition;
• reinforce dominance.

Case 4 — Google Shopping and Data/Identity Intermediation Analogy

The broader Google competition-law proceedings are important because Google's ecosystem connects:

• search;
• advertising;
• browsers;
• operating systems;
• applications;
• authentication;
• user data.

The legal significance is not that every component constitutes a separate market.

Rather, the cases demonstrate the importance of examining ecosystem relationships and competitive leverage.

For identity resolution systems, this means authorities may examine whether control over identity information gives the platform an advantage in adjacent markets.

Case 5 — FTC v Facebook / Meta

Facts

The U.S. Federal Trade Commission brought antitrust proceedings concerning Facebook's conduct involving its social-networking ecosystem and acquisitions.

The proceedings focused substantially on the preservation of Facebook's position in personal social networking and its competitive strategy toward potential rivals.

Legal significance

The case demonstrates the importance of network effects and ecosystem advantages in digital markets.

A platform with a large user base can acquire additional competitive advantages because users and developers prefer ecosystems that already contain large networks.

Relevance to identity resolution

Identity systems intensify this effect.

If a platform can recognise users across multiple services, it can potentially combine:

user identity + social graph + behavioural information + advertising activity.

This can make replication by a new entrant substantially more difficult.

Case 6 — Schrems II

Facts

The Court of Justice of the European Union considered international transfers of personal data and the adequacy of safeguards governing such transfers.

Legal significance

Schrems II is not an antitrust case, but it is important to the regulatory environment surrounding cross-platform identity systems.

It demonstrates that personal-data architecture cannot be treated purely as a commercial resource.

Identity-resolution systems may involve:

• international transfers;
• data processors;
• cloud infrastructure;
• advertising intermediaries;
• third-party analytics.

Competition relevance

A competition-law remedy requiring identity interoperability or data sharing must therefore take account of:

• GDPR requirements;
• security;
• purpose limitation;
• lawful processing;
• international-transfer restrictions.

Thus, competition remedies cannot simply order unrestricted identity-data sharing.

12. Additional Important Authorities

Several other cases help develop the doctrine.

Google Search (AdSense)

The European Commission's Google AdSense decision is relevant to the broader theory of Google's control over advertising intermediation and contractual restrictions.

Microsoft / Commission

The Microsoft interoperability cases demonstrate the importance of interoperability where a dominant technological platform controls interfaces necessary for competing products.

Bronner v Mediaprint

The CJEU's decision is central to refusal-to-deal and essential-facility analysis. It is relevant where a dominant identity infrastructure is claimed to be indispensable to competitors.

IMS Health

IMS Health provides another important framework for assessing when refusal to license or provide access to an infrastructure may become abusive.

Slovak Telekom

The case illustrates how access conditions and leveraging can be analysed when a dominant infrastructure operator controls downstream competition.

13. Identity Resolution and Essential-Facility Doctrine

An identity-resolution system could theoretically acquire essential-facility characteristics where:

1. the identity infrastructure is indispensable;
2. duplication is practically or economically impossible;
3. access is necessary for effective competition;
4. refusal eliminates effective competition;
5. there is no objective justification.

However, the threshold is high.

A company does not automatically have to provide its entire identity database merely because competitors would benefit from it.

14. Data Combination as an Exclusionary Strategy

Consider a dominant platform operating:

• search;
• browser;
• email;
• mobile OS;
• video;
• advertising;
• payment services.

It can potentially create:

Identity Graph

email + browser + mobile device + search + app activity + purchases + location signals

A competing advertising platform may only possess information generated on its own website.

The dominant platform therefore enjoys a cross-context information advantage.

If the platform deliberately prevents competitors from obtaining comparable functionality while reserving it for itself, the issue may become one of exclusionary conduct rather than simple data superiority.

15. Identity Resolution and Switching Costs

Identity portability is therefore increasingly important.

A user who can transfer:

• account identity;
• authentication;
• reputation;
• preferences;
• transaction history;
• contacts;
• subscriptions;

to another platform faces lower switching costs.

Conversely, if identity cannot move, the incumbent can benefit from artificial switching costs.

This gives rise to the concept of:

Identity portability

versus

Identity captivity.

16. Potential Theories of Harm

Competition authorities could examine several theories.

17. Privacy as a Quality Dimension

A useful competition model is:

Competition = Price + Quality + Privacy + Choice + Innovation

In digital services where monetary price is zero, privacy may become an important dimension of quality.

A dominant platform could theoretically weaken privacy competition by:

• making tracking unavoidable;
• preventing privacy-enhancing alternatives;
• making opt-outs difficult;
• combining datasets by default;
• limiting rival privacy-preserving technologies.

The relevant competition question becomes:

Would consumers receive better privacy conditions in a genuinely competitive market?

18. Identity Resolution and Consumer Welfare

The consumer-welfare effects are mixed.

Potential benefits

Identity resolution can provide:

• fraud prevention;
• secure authentication;
• personalised services;
• reduced advertising waste;
• better recommendations;
• account recovery;
• cross-device continuity.

Potential harms

It can also produce:

• pervasive surveillance;
• reduced privacy;
• discriminatory profiling;
• behavioural manipulation;
• reduced consumer choice;
• increased switching costs;
• exclusion of competitors;
• excessive dependence on one identity provider.

Therefore, competition analysis should not assume that all identity resolution is harmful.

19. Remedies

Possible remedies include:

A. Interoperability

Require technically feasible interoperability between competing identity services.

B. API access

Provide competitors with non-discriminatory access to defined interfaces.

C. Data portability

Permit users to transfer relevant identity information.

D. Functional separation

Separate identity infrastructure from downstream advertising operations.

E. Non-discrimination

Require equivalent identity-system access for affiliated and unaffiliated businesses.

F. Tracking choice

Prevent the dominant platform from making participation in unrelated services conditional upon cross-platform tracking where competition law and applicable privacy rules justify intervention.

G. Data silos

Require particular datasets to remain separated rather than being automatically combined.

H. Independent auditing

Require technical monitoring of identity-resolution practices.

20. Limits on Competition Remedies

Competition authorities must be careful because identity systems contain highly sensitive information.

A remedy requiring unrestricted identity sharing could conflict with:

• data-protection law;
• confidentiality;
• cybersecurity;
• authentication security;
• fraud-prevention requirements;
• user consent;
• intellectual-property rights.

Consequently, the appropriate remedy may be functional interoperability rather than raw data disclosure.

For example:

Instead of giving Rival B the entire identity database, Dominant Platform A could be required to permit privacy-preserving identity matching through a controlled interface.

This approach can reduce competitive exclusion without creating an uncontrolled data-transfer mechanism.

21. A Useful Analytical Framework

Competition authorities can analyse an identity-resolution system through seven questions:

1. Who controls the identity layer?

Is it controlled by one platform, several interoperable providers, or an open standard?

2. Is the identity layer commercially indispensable?

Could competitors realistically construct an alternative?

3. What markets depend upon it?

For example:

• advertising;
• analytics;
• payments;
• authentication;
• e-commerce.

4. Can the controller combine information across services?

This determines the strength of the identity graph.

5. Are competitors treated equally?

Compare:

first-party access vs third-party access.

6. Can users switch?

Examine identity portability and switching costs.

7. Does control produce foreclosure?

The ultimate question is whether the system protects legitimate technical functions or artificially strengthens market power.

22. Relationship Between Identity Graph and Market Power

The relationship can be represented as:

Large user base

↓

More identifiers

↓

More accurate identity resolution

↓

More comprehensive identity graph

↓

Superior targeting / measurement

↓

More advertisers and commercial partners

↓

Higher revenues

↓

Further investment in identity infrastructure

↓

Greater barriers to entry

This creates a potentially self-reinforcing identity-data-market-power loop.

23. Key Legal Principle

The central competition-law distinction is:

Possessing data is not necessarily unlawful; using control over identity infrastructure to exclude or disadvantage competitors may be.

Likewise:

Cross-platform tracking is not automatically an abuse of dominance; its competition significance depends upon market power, conduct, effects, indispensability, justification, and the applicable legal framework.

The strongest cases therefore arise where identity resolution is combined with:

• dominance;
• network effects;
• exclusionary restrictions;
• self-preferencing;
• discriminatory access;
• interoperability restrictions;
• tying;
• data combination;
• high switching costs.

24. Key Case-Law Summary

25. Conclusion

Identity resolution systems are potentially becoming a new form of digital infrastructure. Their significance lies not merely in storing identifiers but in the ability to connect identities across otherwise separated platforms, services and behavioural environments.

Where a dominant undertaking controls this capability, it may gain a significant advantage in advertising, analytics, authentication and platform ecosystems. The principal competition-law risks are data-driven entry barriers, cross-market leveraging, self-preferencing, discriminatory access, refusal to interoperate, identity lock-in and restrictions on effective switching.

The Facebook/Meta data-combination proceedings in Germany provide the strongest direct conceptual precedent, while Google Android, Google Shopping, Google AdSense, Microsoft interoperability, Bronner, IMS Health, Slovak Telekom and the U.S. Facebook litigation supply complementary principles.

The emerging legal model is therefore shifting from a narrow question of "who owns the data?" toward a broader structural question:

Who controls the infrastructure that determines whether separate pieces of digital activity can be recognised as belonging to the same economic identity?

That control ca