Competition Law and Identity Verification Market Concentration

1. Introduction

Identity verification market concentration refers to a situation in which a small number of undertakings control a substantial proportion of the market for services used to establish, authenticate, or verify the identity of individuals or businesses.

Identity verification can include:

Know Your Customer (KYC) services;

digital identity verification;

biometric authentication;

document verification;

facial recognition;

liveness detection;

identity databases;

electronic signatures;

authentication APIs;

fraud detection;

age verification;

business identity verification;

digital identity wallets.

Because identity verification is increasingly an infrastructure layer for banking, fintech, telecommunications, e-commerce, healthcare and government services, concentration at this level can have consequences far beyond the identity-verification market itself.

The principal competition-law concern is therefore:

Can control over identity-verification infrastructure allow an undertaking to acquire, maintain or exploit market power in identity verification or to restrict competition in connected downstream markets?

2. Why Identity Verification Is a Competition-Law Issue

Identity verification has several characteristics that can facilitate concentration.

1. Data advantages

Large identity-verification providers may possess extensive datasets that improve:

fraud detection;

document recognition;

biometric matching;

risk scoring;

identity resolution.

This can produce data-driven economies of scale.

2. Network effects

More users and businesses may make a verification network more useful.

3. High switching costs

A business integrating one identity API may need to modify:

software;

compliance systems;

databases;

APIs;

customer onboarding processes.

4. Regulatory barriers

Identity providers often operate in heavily regulated environments.

5. Trust and reputation

Banks and other regulated firms may prefer established verification providers because identity errors can create substantial compliance risks.

6. Interoperability problems

Different identity systems may not communicate easily.

These characteristics can make it difficult for new competitors to enter.

3. Relevant Identity-Verification Markets

Competition authorities should avoid treating "identity verification" as one single market.

Potential markets include:

A. Document verification

Verification of:

passports;

identity cards;

driving licences;

residence permits.

B. Biometric verification

Examples:

facial recognition;

fingerprints;

iris recognition.

C. Digital identity authentication

Authentication of an individual attempting to access an account.

D. Business verification

Verification of companies and beneficial ownership.

E. KYC-as-a-service

Integrated compliance and identity-verification services.

F. Age verification

Verification of whether an individual satisfies a specified age requirement.

G. Identity-data infrastructure

Access to databases or identity attributes.

The relevant market will depend on demand-side substitutability, supply-side substitutability, geography, technology and regulation.

4. Concentration and Market Power

Suppose four companies account for most identity-verification transactions:

The market may be highly concentrated.

However:

Concentration alone does not establish an antitrust violation.

The authority would also investigate:

barriers to entry;

switching costs;

buyer power;

data advantages;

interoperability;

access to identity databases;

regulatory barriers;

technological advantages;

contractual restrictions;

actual competitive effects.

5. The Data Advantage

Identity-verification businesses can benefit from large datasets.

A provider with millions of verification events may improve its algorithms by learning:

document patterns;

fraud patterns;

device characteristics;

identity relationships;

behavioural indicators.

This can create a feedback loop:

More customers

↓

More verification transactions

↓

More data

↓

Better fraud detection

↓

More customers

↓

More data

This can produce a data-driven network effect.

6. The Competition Concern

The problem arises if a dominant provider uses its data advantage to make entry or expansion extremely difficult.

For example:

Large incumbent

→ extensive identity data

→ superior verification accuracy

→ more customers

→ more data.

Meanwhile:

New entrant

→ limited data

→ potentially lower accuracy

→ fewer customers

→ limited data.

This can create an entry barrier based on accumulated data.

However, possession of data is not inherently anticompetitive. Competition law must establish how the data advantage affects competition.

7. Important Case Law

1. Google Search (Shopping) — Google v Commission

Case C-48/22 P, Google and Alphabet v Commission

The Google Shopping litigation concerned Google's treatment of comparison-shopping services within its general search results.

The case is important for understanding how a dominant digital platform can potentially use control over an important infrastructure layer to disadvantage competing services.

Identity-verification relevance

An identity platform may similarly occupy a gateway position.

For example:

Identity infrastructure

↓

authentication

↓

access to banking / fintech / e-commerce services

If the identity provider favours its own downstream products, competition concerns could arise.

The important principle is that dominance over one digital infrastructure layer can have competitive consequences in adjacent markets.

8. Google Android

Case AT.40099 — Google Android

The European Commission examined Google's practices involving Android, including contractual restrictions connected with access to important components of the mobile ecosystem.

The case demonstrates how control over a foundational technological ecosystem can affect competition in adjacent markets.

Identity-verification relevance

An identity-verification provider could similarly leverage a strong position in authentication to expand into:

payments;

fraud prevention;

digital wallets;

lending;

e-commerce;

advertising.

The competition concern is particularly significant where access to the identity layer becomes necessary for participation in downstream markets.

9. Microsoft v Commission

Case T-201/04, Microsoft v Commission

The Microsoft litigation involved interoperability and the relationship between Microsoft's dominant operating-system position and neighbouring software markets.

A central competition issue was whether withholding interoperability information could restrict competitors.

Identity-verification relevance

Interoperability is extremely important in identity markets.

A dominant identity provider might control:

authentication APIs;

identity attributes;

verification protocols;

identity credentials.

If competitors cannot effectively interoperate with the dominant system, their ability to compete may be impaired.

Thus, identity interoperability can become a competition issue analogous to interoperability problems in technology platforms.

10. Bronner v Mediaprint

Case C-7/97

The Court of Justice examined whether a dominant undertaking could be required to provide access to an infrastructure.

The Court adopted a stringent approach to compulsory access.

Identity-verification relevance

Consider a situation in which one undertaking controls a uniquely important identity-verification infrastructure.

A competitor requests access.

The competition analysis could ask:

Is the identity infrastructure indispensable?

Can an alternative verification system be developed?

Is duplication economically or technically feasible?

Would refusal eliminate effective competition?

Is there objective justification for refusal?

The case therefore provides an important framework for assessing refusal to provide access to identity infrastructure.

11. IMS Health v Commission

Cases C-418/01 P and C-7/97

IMS Health concerned access to a commercially important data structure.

The Court examined circumstances in which refusal to license or provide access to an important input might constitute abuse of dominance.

Identity-verification relevance

Identity systems can contain commercially important:

identity attributes;

verification databases;

authentication information;

data structures.

If a dominant provider controls a genuinely indispensable data resource, refusal to provide access could potentially raise similar issues.

However, the stringent legal requirements for compulsory access remain important.

12. Magill

Joined Cases C-241/91 P and C-242/91 P

Magill concerned refusal to provide information necessary for competing television programme publications.

The case is relevant because it established the exceptional circumstances under which refusal to supply an important input can constitute abuse of dominance.

Identity-verification relevance

The analogy becomes relevant where:

a dominant provider controls indispensable identity information;

rivals cannot realistically reproduce the information;

refusal prevents a viable competing service;

the refusal lacks objective justification.

Again, mere ownership of valuable data does not automatically create an access obligation.

13. Commercial Solvents

Joined Cases 6/73 and 7/73

Commercial Solvents involved a dominant undertaking controlling an upstream input and refusing to supply a downstream competitor.

The case demonstrates the principle that an undertaking controlling an essential upstream resource may not necessarily use that position to eliminate downstream competition.

Identity-verification relevance

Suppose a dominant identity-verification company controls an upstream identity attribute or authentication service and also competes in a downstream market.

For example:

Identity verification

↓

authentication

↓

digital financial services

If the provider restricts access to the upstream identity resource to disadvantage downstream rivals, the Commercial Solvents principle becomes relevant.

14. United Brands

Case 27/76

United Brands is an important authority on dominance and abusive conduct, including discriminatory treatment and unfair commercial conditions.

Identity-verification relevance

A dominant identity-verification provider might potentially treat customers differently.

For example:

Bank A receives favourable API access;

Bank B faces substantially higher fees;

competing identity provider C receives restrictive technical conditions.

Where similarly situated customers receive discriminatory treatment that affects competition, Article 102-type analysis may arise.

15. Facebook / Meta Data-Related Competition Issues

The European Commission's investigations involving Meta provide important context for the intersection of data and platform market power.

Data can be both:

an input into digital services; and

a competitive advantage.

Identity-verification relevance

Identity verification generates particularly valuable datasets because identity data can be used across:

authentication;

fraud prevention;

customer onboarding;

risk analysis.

A dominant provider combining identity information with unrelated datasets could potentially strengthen its position in adjacent markets.

The relevant competition question would be whether such data practices constitute an exclusionary or exploitative abuse rather than merely being commercially advantageous.

16. Self-Preferencing

A major concern is self-preferencing.

Imagine a company operating:

a dominant identity-verification service;

a fraud-detection service.

It could potentially give its own fraud-detection product:

faster verification;

richer data;

preferential API access;

lower internal transfer prices.

Competitors may receive less favourable conditions.

This resembles broader digital-platform concerns involving control of an upstream gateway.

17. Tying and Bundling

Identity verification can be bundled with other services.

For example:

"To use our KYC service, you must also purchase our fraud-detection product."

Or:

"Access to our identity API requires use of our payment-processing service."

If the identity service is dominant, tying can potentially extend market power into an adjacent market.

Relevant competition-law questions include:

Are the products distinct?

Is the undertaking dominant in the tying product?

Are customers forced to purchase the second product?

Does the practice foreclose competitors?

Are there efficiencies?

18. Exclusive Dealing

A dominant identity provider might offer favourable pricing if a customer agrees:

"Use our identity-verification services exclusively."

Exclusive arrangements can make market entry difficult when the provider has substantial market power.

This becomes especially significant if major banks, telecom operators or e-commerce platforms account for a large proportion of demand.

19. Switching Costs

Identity verification has unusually high switching costs.

A company changing providers may have to:

rewrite API integrations;

retest compliance systems;

retrain staff;

modify risk models;

migrate customer records;

obtain regulatory approval;

conduct security assessments.

These costs can reduce competitive pressure.

If an incumbent deliberately increases technical switching costs, competition concerns can become stronger.

20. Interoperability

Interoperability can be one of the most important competition issues.

Suppose:

Identity Provider A

does not permit interoperability with:

Identity Provider B.

Users may therefore become locked into A.

This creates:

Network effect + switching cost + data advantage

which may produce durable market power.

Competition authorities may therefore examine:

API access;

authentication standards;

credential portability;

identity-data portability;

technical protocols.

21. Identity Portability

Portability can reduce concentration.

If customers can easily transfer:

identity attributes;

verification history;

credentials;

authentication records;

from Provider A to Provider B, switching becomes easier.

Conversely, if data is technically or contractually locked into one provider, the incumbent may gain greater market power.

22. APIs as Competitive Infrastructure

Identity verification is increasingly API-driven.

An API may allow a company to:

verify an identity;

check a document;

conduct biometric matching;

authenticate a user;

retrieve identity attributes.

A dominant API provider may therefore become an infrastructure gatekeeper.

Competition questions include:

Can rivals access the API?

Are access terms discriminatory?

Are technical specifications withheld?

Is access priced excessively?

Are rival services interoperable?

23. Identity Verification and AI

AI increases the competitive importance of identity data.

AI systems can improve:

document recognition;

facial matching;

fraud detection;

anomaly detection;

synthetic identity detection.

A provider with access to large datasets may therefore develop stronger AI models.

This creates another feedback loop:

Data

→ AI model

→ better verification

→ more customers

→ more data

The competition issue is whether this creates merely legitimate innovation or an entry barrier reinforced by exclusionary conduct.

24. Biometric Identity Markets

Biometric verification introduces additional concentration risks.

A small number of firms may possess important:

biometric algorithms;

training datasets;

liveness systems;

hardware;

authentication infrastructure.

Potential competition issues include:

exclusive biometric databases;

interoperability restrictions;

tying biometric hardware to software;

discriminatory access;

acquisition of emerging biometric competitors.

25. Government Identity Infrastructure

Government-backed identity infrastructure creates a special competition environment.

For example, a public identity system may become an important input for:

banking;

telecom;

insurance;

e-commerce;

public services.

Private firms may build complementary services around the system.

Competition questions may concern:

equal access;

technical interoperability;

licensing;

data access;

private-sector participation;

preferential treatment.

A government identity system itself is not automatically a competition problem, but access rules can affect competition among private providers.

26. India and Identity Verification

India presents particularly important competition-law questions because identity verification is relevant to:

banking;

fintech;

telecom;

payments;

insurance;

e-commerce;

digital lending.

The Competition Act, 2002 can potentially become relevant where identity-verification providers engage in:

anti-competitive agreements under Section 3;

abuse of dominant position under Section 4;

combinations under Sections 5 and 6.

27. Section 3 and Identity Verification

Potential Section 3 concerns could arise through:

Competitor agreements

Identity providers agree not to compete for particular customers.

Market allocation

Providers divide:

banks;

telecom companies;

geographic regions;

customer categories.

Information exchange

Competitors exchange:

pricing information;

customer information;

capacity information;

future commercial strategies.

Exclusive arrangements

Competitors coordinate contractual exclusivity.

28. Section 4 and Identity Verification

If an identity-verification undertaking is dominant in a relevant market, potential abuses could include:

Refusal to deal

Refusing access to an indispensable verification service.

Discrimination

Different access conditions for competing customers.

Unfair pricing

Potentially excessive charges.

Tying

Conditioning identity verification on purchase of another service.

Self-preferencing

Giving an affiliated service preferential access.

Predatory pricing

Pricing identity verification below an appropriate cost benchmark to eliminate rivals.

Denial of interoperability

Preventing competing identity systems from connecting.

29. Merger Control

Identity verification may become increasingly concentrated through acquisitions.

A large company might acquire:

a biometric startup;

a KYC provider;

an identity-data company;

an authentication platform;

a fraud-detection provider.

Competition authorities should consider not only current market shares but also innovation competition.

An acquisition may eliminate a potential future competitor even if the target currently has a small market share.

This is particularly relevant where the target possesses:

proprietary technology;

unique datasets;

strong developer adoption;

rapidly growing customer base.

30. Killer Acquisitions in Identity Verification

A dominant identity platform might acquire a promising startup before it becomes a significant competitor.

The acquisition could eliminate:

an emerging biometric technology;

a decentralized identity system;

an innovative verification model;

a privacy-preserving authentication system.

Therefore, merger analysis may need to examine potential competition as well as existing market shares.

31. Data as an Entry Barrier

A central question is:

Can competitors obtain equivalent data?

If identity data is:

widely available;

replicable;

commercially obtainable;

the data advantage may be less durable.

If it is:

unique;

difficult to reproduce;

legally restricted;

accumulated over many years;

the competitive significance may be greater.

The competition authority must therefore examine the contestability of the data advantage.

32. Privacy and Competition Law

Privacy and competition law are distinct legal regimes, but they can intersect.

Poor privacy practices do not automatically constitute an antitrust violation.

However, privacy can become relevant where:

users cannot switch because of data portability barriers;

a dominant provider degrades privacy after competition has weakened;

data combination reinforces market power;

competitors cannot access necessary data on reasonable terms.

The competition analysis must nevertheless establish the relevant competition harm rather than treating privacy concerns as automatically equivalent to antitrust injury.

33. Identity Verification as a Two-Sided Market

Many identity platforms connect:

Users

with

Businesses requiring verification.

This can create two-sided network effects.

More users:

→ more attractive to businesses.

More businesses:

→ more useful to users.

This can generate concentration rapidly.

The authority therefore needs to analyse both sides of the platform rather than examining only the price paid by businesses.

34. Zero-Price Services

Some identity services may be offered free to users.

A zero monetary price does not mean there is no competition issue.

The provider may compete through:

privacy;

speed;

accuracy;

security;

interoperability;

convenience.

Competition analysis therefore needs to account for non-price dimensions of competition.

35. Relevant Economic Effects

Potential anticompetitive effects include:

Higher prices

Businesses pay more for verification.

Lower quality

Verification accuracy may deteriorate.

Reduced innovation

New verification technologies struggle to enter.

Reduced privacy

Competitive pressure may decline.

Reduced interoperability

Users become locked into one identity ecosystem.

Foreclosure

Rival providers cannot reach customers.

Reduced consumer choice

Businesses and individuals have fewer alternatives.

36. Possible Procompetitive Benefits

Concentration is not always harmful.

Large identity-verification networks can generate:

stronger fraud detection;

lower unit costs;

greater security;

interoperability;

faster verification;

investment in AI;

improved reliability.

A competition authority should therefore distinguish:

economies of scale

from

exclusionary exploitation of scale.

This is particularly important because identity verification is a security-sensitive service.

37. Remedies

Potential competition-law remedies could include:

Access remedies

Require reasonable access to critical infrastructure.

Interoperability

Require technical interoperability.

Data portability

Make switching easier.

Non-discrimination

Require equal treatment of similarly situated users.

Contractual remedies

Restrict excessive exclusivity.

Structural remedies

In exceptional merger cases, divestiture may be considered.

Behavioural remedies

Prohibit:

tying;

self-preferencing;

discriminatory access;

exclusionary contracts.

38. Six Core Case-Law Principles

The major cases can be summarized as follows:

39. Competition-Law Analytical Framework

A competition authority examining identity-verification concentration can follow this sequence:

1. Define the relevant identity market

↓

2. Define the geographic scope

↓

3. Measure concentration

↓

4. Identify barriers to entry

↓

5. Assess data advantages

↓

6. Assess network effects

↓

7. Examine switching costs

↓

8. Examine interoperability

↓

9. Identify potentially exclusionary conduct

↓

10. Measure competitive effects

↓

11. Consider efficiency justifications

↓

12. Determine proportionate remedies

40. Conclusion

Identity verification is increasingly becoming a foundational digital infrastructure market, making concentration within it potentially important to competition far beyond the identity-verification sector itself.

The most significant concerns arise where a provider combines:

large identity datasets + network effects + regulatory trust + interoperability control + high switching costs + vertical integration.

Such a combination can create substantial and durable market power.

The case law provides several important principles. Bronner, IMS Health and Magill establish the demanding framework for exceptional access to indispensable infrastructure or information. Commercial Solvents illustrates the danger of using upstream control to exclude downstream competitors. Microsoft demonstrates the importance of interoperability. United Brands provides principles concerning dominance and discriminatory conduct, while the Google cases illustrate how control of an important digital ecosystem can affect competition in neighbouring markets.

For India, the Competition Act, 2002 provides the principal competition-law framework. Identity-verification concentration can potentially implicate Section 3 where firms coordinate, Section 4 where a dominant provider engages in exclusionary or exploitative conduct, and Sections 5–6 where mergers and acquisitions materially alter competition.

The central legal challenge is therefore to preserve the security, reliability and efficiency benefits of large identity networks without allowing control over identity infrastructure, data or authentication systems to become a mechanism for foreclosing competitors, restricting interoperability, increasing switching costs, or extending dominance into adjacent digital markets.