Identity Verification Platform Monopoly Risks

1. Introduction

Identity verification platforms are digital systems that authenticate, verify, score, or establish the identity of individuals or businesses. They may rely on government identity documents, biometric information, device signals, credit information, behavioural data, telecom records, financial information, or cross-platform identity graphs.

Examples include systems used for:

• digital banking and KYC;
• payment authentication;
• employment and gig-work onboarding;
• age verification;
• e-commerce fraud prevention;
• government digital services;
• travel and border services;
• healthcare access;
• platform account creation;
• digital signatures and trust services.

A monopoly or dominant position in identity verification can create competition problems that differ from ordinary platform dominance. Identity verification may become a gateway to participation in downstream markets. If one provider controls the verification infrastructure, it may determine who can enter markets, what information competitors can access, how users are authenticated, and whether users can transfer their verified identity elsewhere.

The central competition concern is therefore:

Control over identity verification can become control over access to digital markets.

2. How an Identity Verification Monopoly Can Develop

An identity-verification platform can acquire substantial market power through several reinforcing mechanisms.

A. Data accumulation

The platform may accumulate:

• identity attributes;
• biometric identifiers;
• transaction histories;
• device identifiers;
• behavioural information;
• fraud records;
• authentication histories;
• reputation information.

The larger the identity database becomes, the more difficult it may be for entrants to reproduce its verification accuracy.

B. Network effects

More users generate more identity data.

More data can improve:

verification accuracy → fraud detection → customer trust → platform adoption → additional users → additional data.

This can produce a self-reinforcing competitive advantage.

C. Switching costs

Businesses integrating a verification API may invest heavily in:

• software integration;
• compliance systems;
• risk models;
• customer onboarding;
• regulatory approvals;
• internal databases.

Once integrated, moving to another provider may become expensive.

D. Reputation effects

A recognised verification provider may become a trusted intermediary.

Businesses may prefer a provider simply because:

"verified by X"

has acquired reputational significance.

This can make reputation itself a barrier to entry.

E. Regulatory dependence

Where regulators, banks, payment systems, employers, or government services accept one identity-verification standard more readily than alternatives, the platform can obtain a quasi-regulatory gateway position.

3. The Principal Monopoly Risks

A. Refusal to Provide Access

A dominant identity platform may refuse access to its verification infrastructure to competitors or downstream businesses.

For example, an identity provider could refuse API access to a competing fintech platform while continuing to supply its own affiliated fintech business.

The competition-law question becomes whether the identity infrastructure constitutes an essential facility or indispensable input.

This connects identity verification with the essential-facilities doctrine.

B. Discriminatory Verification

A dominant platform could impose different:

• verification thresholds;
• API limits;
• prices;
• fraud-screening standards;
• response times;
• access conditions

on competing businesses.

If its own downstream business receives preferential treatment, this may constitute self-preferencing or discriminatory access.

C. Identity Data Advantage

The platform may possess data that competitors cannot realistically reproduce.

For example:

Platform A

500 million verified identities + historical fraud information

versus

New entrant

newly collected identity information.

Even if both companies have similar algorithms, the incumbent may enjoy a significant data advantage.

This can create a data-based barrier to entry.

4. Identity Verification as a Bottleneck

The most serious competition concern arises when identity verification becomes a bottleneck input.

Consider:

Individual → Identity verification platform → Bank/payment platform → Digital service

If the verification provider can determine whether the individual is recognised as legitimate, it may effectively control downstream access.

This is especially significant where verification is required for:

• opening bank accounts;
• accessing payment services;
• joining labour platforms;
• accessing government services;
• purchasing regulated products;
• entering digital marketplaces.

The identity platform can therefore acquire gatekeeper power.

5. Tying and Bundling

A dominant provider might require customers purchasing identity verification also to purchase:

• fraud detection;
• credit scoring;
• advertising services;
• cloud services;
• payment processing;
• authentication;
• analytics.

For example:

"You may use our identity-verification service only if you also use our fraud-prevention platform."

Such arrangements may raise concerns under rules governing tying and bundling by dominant firms.

6. Exclusive Dealing

A platform might require major banks, marketplaces, employers, or payment companies to use its identity-verification service exclusively.

This can prevent competitors from achieving the scale necessary to enter the market.

The danger is particularly serious where identity verification exhibits strong network effects.

An exclusive agreement with a sufficiently large group of customers can create:

foreclosure → reduced scale for rivals → reduced competition → stronger incumbent dominance.

7. Interoperability and Identity Portability

Another major risk is identity lock-in.

Suppose a consumer has spent years building a verified digital identity.

The identity contains:

• verified name;
• age;
• address;
• business credentials;
• authentication history;
• reputation;
• fraud history.

If that identity cannot be transferred to competing verification providers, the consumer may have to start again.

This produces identity switching costs.

Competition law may therefore increasingly intersect with:

• data portability;
• interoperability;
• API access;
• authentication standards;
• digital identity regulation.

8. Self-Preferencing

Suppose an identity-verification company operates a marketplace as well.

It could theoretically use its control over verification to favour its own marketplace.

For example:

independent sellers → additional verification requirements
affiliated sellers → simplified verification.

That could disadvantage competing downstream firms.

The relevant competition concern is not simply the existence of vertical integration. It is whether the dominant firm uses control over an upstream bottleneck to distort downstream competition.

9. Predatory or Exclusionary Pricing

A dominant platform could initially provide identity verification:

free or below cost

to eliminate competing providers.

After competitors exit, the platform could increase prices substantially.

Alternatively, the dominant firm could use revenues from another market to subsidise identity verification.

This raises potential predatory pricing and cross-subsidisation issues.

10. Excessive Pricing

The reverse problem is also possible.

Where customers have no practical alternative, the identity platform may charge excessive fees.

This becomes particularly significant where verification is effectively mandatory.

The competition authority may have to determine:

1. whether the provider is dominant;
2. whether customers lack realistic alternatives;
3. whether the price is excessive;
4. whether the pricing is unfair;
5. whether regulation provides a better solution.

11. Quality Degradation as an Antitrust Problem

Identity platforms may harm competition without increasing prices.

For example, they could reduce:

• verification accuracy;
• customer support;
• transparency;
• privacy protections;
• processing speed;
• appeal mechanisms.

In digital markets, quality and privacy can constitute important dimensions of competition.

Consequently, a monopoly may cause consumer harm through deterioration in non-price conditions.

12. Algorithmic Exclusion

Identity platforms increasingly rely on automated systems to determine whether someone is trustworthy.

An algorithm might classify a person as:

• high risk;
• suspicious;
• fraudulent;
• unverifiable;
• potentially synthetic;
• requiring enhanced verification.

If competitors cannot reproduce the incumbent's historical data, they may be unable to challenge these classifications effectively.

A dominant platform could therefore possess algorithmic control over market participation.

13. Error-Correction and Due-Process Problems

Identity verification errors can have enormous economic consequences.

A false rejection can prevent someone from:

• opening a bank account;
• accessing a marketplace;
• receiving payment;
• obtaining employment;
• using a digital service.

If the dominant provider also controls the appeal process, there may be no competitive alternative.

This creates a distinctive form of procedural lock-in.

14. Privacy as a Competition Dimension

Identity monopolies can also produce privacy-related competition concerns.

A dominant platform may collect progressively more information because customers cannot realistically switch.

The competitive harm may therefore appear as:

less privacy + greater surveillance + weaker user control

rather than simply higher monetary prices.

This is particularly important for multi-sided digital markets where users may pay nothing directly.

15. Relevant Case Laws

The following cases provide important legal principles that can be applied to identity-verification platform monopolies.

1. United Brands v Commission

Case 27/76, Court of Justice of the European Union

The Court examined dominance, dependence, and abusive conduct involving a powerful undertaking.

Relevance

Identity-verification providers could similarly become indispensable commercial partners for downstream businesses.

The case is useful for analysing:

• economic dependence;
• dominance;
• abusive conduct;
• market power.

2. Commercial Solvents v Commission

Joined Cases 6/73 and 7/73

The Court recognised that a dominant undertaking controlling an important input could abuse its position by restricting supplies to downstream competitors.

Relevance

This is highly relevant to identity verification.

If a dominant verification provider controls an indispensable authentication input and restricts access to competing downstream platforms, the conduct could resemble an input foreclosure strategy.

3. Bronner v Mediaprint

Case C-7/97

The Court established important principles concerning refusal to supply and essential facilities.

The Court required stringent conditions before a refusal to deal could constitute abuse.

Relevance

For identity verification, the key question would be whether:

access to the identity-verification infrastructure is objectively indispensable for competitors.

If alternative verification systems realistically exist, the essential-facilities argument becomes weaker.

If no viable alternative exists, the case becomes much more significant.

4. IMS Health v Commission

Case C-418/01

The case concerned access to a protected information structure and the circumstances in which refusal to license could become abusive.

The Court developed important principles concerning:

• indispensability;
• exclusion of competition;
• prevention of new products;
• justification for refusal.

Relevance

An identity platform possessing a unique identity database or identity architecture could face similar questions.

For example:

Can competitors realistically establish equivalent identity verification without access to the incumbent's identity infrastructure?

5. Microsoft v Commission

Case T-201/04

The General Court upheld major aspects of the Commission's finding that Microsoft had abused its dominant position through restrictions involving interoperability information.

Relevance

This is especially important for identity interoperability.

A dominant identity provider could potentially restrict:

• API interoperability;
• authentication protocols;
• identity portability;
• technical specifications.

The Microsoft principle demonstrates the competition significance of technical interoperability where exclusionary effects arise.

6. Google Shopping

Case T-612/17

The General Court examined Google's conduct concerning preferential positioning of its own comparison-shopping service.

Relevance

The case is highly relevant to self-preferencing.

An identity-verification platform that operates downstream services could theoretically:

favour its own services in verification, authentication, ranking, or access decisions.

The case provides an important framework for analysing discriminatory treatment of rivals through a dominant platform's infrastructure.

7. Google Android

Case T-604/18

The General Court examined Google's contractual and technological practices concerning Android and associated services.

Relevance

The case is useful for analysing:

• tying;
• contractual restrictions;
• ecosystem effects;
• leveraging dominance;
• barriers to competing services.

Identity verification platforms may similarly use contractual or technological restrictions to reinforce ecosystem dominance.

8. Slovak Telekom v Commission

Joined Cases C-165/19 P and C-166/19 P

The Court examined exclusionary conduct involving access to infrastructure and the relationship between competition law and regulated infrastructure.

Relevance

Identity verification may increasingly resemble regulated digital infrastructure.

Where a dominant platform controls infrastructure that downstream businesses require, competition authorities may need to distinguish legitimate commercial freedom from exclusionary foreclosure.

9. Facebook Ireland / Meta Data Case

The proceedings concerning Facebook's collection and use of personal data illustrate the increasing relationship between data practices and competition law.

Relevance

Identity platforms are particularly data-intensive.

The competitive analysis may therefore consider:

• data concentration;
• privacy conditions;
• combining datasets;
• user dependency;
• exploitative data practices.

The broader lesson is that data-related conduct can become relevant to market-power analysis, particularly in digital ecosystems.

16. Consolidated Case-Law Principles

17. Competition-Law Test

A competition authority examining an identity-verification monopoly would normally proceed through several questions.

Step 1 — Define the relevant market

Possible markets include:

• identity verification;
• digital identity services;
• biometric authentication;
• KYC services;
• age verification;
• business verification;
• fraud-prevention identity services.

The market may need to distinguish between different customer groups.

Step 2 — Determine dominance

Relevant factors include:

• market share;
• data advantages;
• network effects;
• switching costs;
• interoperability;
• regulatory recognition;
• access to identity infrastructure;
• barriers to entry.

Step 3 — Identify exclusionary conduct

Potential conduct includes:

• refusal to supply;
• discriminatory access;
• tying;
• bundling;
• exclusive dealing;
• self-preferencing;
• interoperability restrictions;
• predatory pricing;
• discriminatory algorithms.

Step 4 — Establish foreclosure

The authority must examine whether rivals are actually or potentially prevented from competing.

Step 5 — Examine objective justification

The identity provider may argue that restrictions are necessary for:

• cybersecurity;
• fraud prevention;
• privacy;
• regulatory compliance;
• data protection;
• technical reliability.

These justifications should be tested for proportionality.

18. Special Problem: Security as a Monopoly Defence

Identity verification is different from many digital services because security genuinely matters.

A provider may legitimately argue:

"We cannot provide unrestricted API access because doing so would increase identity fraud."

Therefore, competition law should not automatically require unrestricted interoperability.

The appropriate question is:

Is the restriction objectively necessary and proportionate to the legitimate security objective, or is security being used as a pretext for exclusion?

This distinction is likely to become increasingly important.

19. Remedies

Possible competition remedies include:

Structural remedies

• divestiture;
• separation of identity and downstream businesses;
• functional separation.

Behavioural remedies

• non-discriminatory API access;
• transparent verification criteria;
• interoperability requirements;
• reasonable access pricing;
• prohibition of exclusive contracts.

Data remedies

• data portability;
• interoperability;
• controlled data sharing;
• restrictions on combining datasets.

Governance remedies

• independent audits;
• algorithmic accountability;
• appeal mechanisms;
• explanation requirements;
• independent dispute resolution.

Regulatory remedies

Where identity verification becomes critical infrastructure, competition law may need to work alongside:

• data protection law;
• digital-services regulation;
• financial regulation;
• cybersecurity regulation;
• consumer protection.

20. Overall Assessment

The most serious risk from an identity verification platform monopoly is not simply excessive pricing.

It is the emergence of a digital identity gatekeeper capable of determining which firms, individuals, and services can participate in digital markets.

The competitive risks can be represented as:

Identity data concentration
↓
Verification accuracy advantage
↓
Network effects
↓
Higher switching costs
↓
Market dominance
↓
API/interoperability control
↓
Foreclosure of rivals
↓
Downstream ecosystem dependence

Thus, identity verification may evolve from an ordinary ancillary service into critical digital infrastructure.

The strongest legal precedents are Commercial Solvents, Bronner, IMS Health, Microsoft, Google Shopping, Google Android, and Slovak Telekom, because together they provide a framework for analysing essential inputs, interoperability, refusal to deal, self-preferencing, tying, and infrastructure foreclosure.

In competition-law terms, the central concern is therefore not merely who verifies identity, but whether control over identity verification gives one undertaking the power to control access to markets themselves.