Policymakers and scholars concerned with the power of informational platforms are questioning how traditional doctrinal silos like privacy law and antitrust law interact in digital markets. Their interaction has taken on new urgency in recent years as states have enacted a flurry of consent-based privacy laws and as digital markets have become increasingly dominated by the same few firms.

Contemporary debates about the interaction of competition and privacy tend to ask what role, if any, privacy should play in the antitrust analysis. Little has been written about how new privacy laws shape the competitive landscape. This Article argues that consent-based privacy laws confer three distinct powers on entrenched incumbent firms. 

The first is the power to comply. Dominant firms realize economies of scale in any regulatory compliance regime, but they are uniquely advantaged by the need to obtain consent to collect and process users’ information. The second is the power to restrict. By constraining information flows, privacy laws deprive insurgents of access to data that could prove valuable in challenging incumbents’ dominance, and consent mechanisms exacerbate the dynamic by supplying incumbents with a legal justification for refusing to share their data and circumscribing competitors’ access to it. The third is the power to circumvent. A private-sector initiative that limits the collection and sharing of advertising-related information shows that stringent consent mechanisms may deprive all firms of some data, but incumbents with sufficient scale — and only such firms — can circumvent and overcome these restrictions. 

Taken together, the three powers of incumbency suggest that laws like the California Consumer Privacy Act will further entrench dominant informational platforms like Meta’s and Google’s — and they thereby raise difficult questions for those who seek to curb platform power. Ultimately, privacy law’s incumbency problem suggests pessimism about pursuing competition to the exclusion of other policies and about the prevailing approach to privacy law.